-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fastapi-sso | pip | < 0.19.0 | 0.19.0 |
Miggo AIRoot Cause AnalysisThe analysis of the security patch for CVE-2025-14546 in fastapi-sso clearly points to a CSRF vulnerability within the OAuth callback handling. The commit 6117d1a5ad498ba57d671e8a059ebe20db5abe02 reveals that the verify_and_process method in fastapi_sso/sso/base.py was modified to enforce state validation. Before the patch, the function would accept the state parameter from the URL query (request.query_params.get("state")) without any verification. This is the core of the vulnerability. The fix involves storing the generated state in a browser cookie (response.set_cookie("sso_state", state)) within the get_login_redirect function and then comparing this cookie value with the state parameter received in the callback within verify_and_process. The absence of this comparison in the vulnerable versions is what allows the CSRF attack. Therefore, the SSOBase.verify_and_process function is the primary vulnerable function that would be hit during exploitation.
SSOBase.verify_and_processfastapi_sso/sso/base.py