Leantime implements an OAuth‑OpenID Connect login flow that depends on a verifyState() function. The function, however, always returns true, ignoring the state value supplied by the OIDC provider. Because the state parameter is never validated, an attacker can construct a callback URL containing a malicious authorization code and direct a victim to it. When the victim completes the OIDC authentication step, the callback is processed by Leantime, the bogus state is accepted, and the victim’s session token is replaced with the attacker’s credentials. The result is a session‑fixation or authentication‑bypass scenario that allows the attacker to gain unauthorized access as the victim without needing to compromise the victim’s credentials.

Any installation of Leantime that has not yet incorporated the update you can see in commit 9630eb7db682fb1b4e23cdabf3428d03ec6f5094 is vulnerable. The vendor list does not specify a version the unpatched code base is at risk.

The CVSS score of 8.6 classifies the flaw as high severity, while an EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote deception: an attacker requires the victim to follow a crafted callback URL, which can be achieved via social engineering or an email link. Once the victim completes the OIDC flow, the attacker gains session control or the ability to log in as the victim. Because the vulnerability allows an attacker to establish a valid session without authenticating, the risk to confidentiality and integrity is significant once a victim is lured into the flow.