The vulnerability arises because Livebook Teams identity callbacks do not include any tied state or nonce verification. When a user completes the OAuth-style login flow, Livebook stores the resulting access token in the browser session without confirming that the callback corresponds to the session that originally requested authentication. Consequently, an actor can obtain an authorization code on behalf of the victim, then trigger the victim’s browser to redeem that code, thereby creating a session authenticated as the attacker. The attacker gains no direct credentials of the victim and cannot impersonate the victim, but the victim’s activity, data, and secrets become associated with the attacker’s account, exposing sensitive content and enabling ongoing misuse of the victim’s session.

Livebook, versions from 0.15.0 up to but not including 0.18.7 and from 0.19.0 up to 0.19.9. All vendors use livebook-dev:livebook. The flaw is present only when Livebook is configured to use Livebook Teams for identity.

The CVSS score of 6.8 marks this CSRF flaw as moderately severe. With no publicly known exploitation and an EPSS score not available, the likelihood of widespread attack is currently low, but the vulnerability is not listed in CISA KEV. An attacker must be a member of the same Livebook Teams organization to prepare the code and deliver it to the victim, and the authorization code must be redeemed within a short window after login initiation, which limits the timing window but does not prevent the attack. If exploited, the victim’s work and secrets would automatically belong to the attacker’s account, posing both confidentiality and integrity risks to the organization. The attack vector is most likely a crafted URL or hyperlink that the victim clicks while Authenticated but unaware of the CSRF.