CVE-2026-59713: Leantime OIDC Session Fixation via Missing State Parameter Validation

Technical summary

CVE-2026-59713 exploits a flaw in Leantime's verifyState() method within the OIDC authentication flow. The vulnerability stems from the method unconditionally returning true without cryptographic validation of the OAuth 2.0 state parameter—a standard CSRF protection mechanism. In a compliant OIDC implementation, the state parameter is a unique, server-generated value issued during the authorization request and validated upon callback to ensure the callback originated from the same user session that initiated the request. By omitting this check, Leantime allows an attacker to supply an authorization code obtained from their own OIDC provider account in a crafted callback URL. When a victim visits this URL, they are logged into the Leantime instance as the attacker, with the victim's browser session bound to the attacker's identity. This is classified as CWE-352 (Cross-Site Request Forgery) because it violates the CSRF principle that all state-changing operations must be validated via unique, per-request tokens.

Business impact

Compromised user accounts in Leantime can lead to unauthorized access to project management data, task assignments, timelines, and potentially sensitive attachments or communications. In organizations using Leantime for resource planning, an attacker account could be used for reconnaissance, data exfiltration, or disruption of project workflows. If Leantime integrates with other systems via API tokens or linked accounts, the foothold may extend beyond the project management platform. The need for user interaction (clicking a malicious link) reduces immediate enterprise-wide risk but remains significant in spear-phishing or watering-hole scenarios targeting specific users or teams.

Affected systems

All versions of Leantime employing the vulnerable verifyState() method in OIDC login are affected. The source data does not list specific version ranges; organizations using Leantime with OIDC authentication should assume their deployment is at risk and consult the vendor advisory for precise version information and patched releases.

Exploitability

The vulnerability is highly exploitable (CVSS 8.1 / HIGH severity) because it requires no authentication, no special privileges, and minimal complexity—only network access and social engineering to deliver a malicious link to a target user. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) reflects that user interaction is necessary (the victim must click the link), but once that occurs, the attacker gains high-confidence confidentiality and integrity impact through account hijacking. No known public exploits are indexed in CISA's Known Exploited Vulnerabilities catalog as of the latest available data.

Remediation

The core remediation is to patch Leantime to a version that properly validates the state parameter in the verifyState() method. Verify against the vendor advisory for the specific patched version and deployment method applicable to your installation. As an interim mitigation, disable OIDC login if not critical to operations, reverting to local authentication. Organizations can also educate users about phishing attempts and implement email security controls to reduce the likelihood of malicious links reaching employees. Monitor Leantime logs for unusual login patterns or sessions authenticating from unexpected geographic locations.

Patch guidance

Obtain the latest patched version of Leantime from the official vendor repository or advisory. The patch must include cryptographic validation of the state parameter before accepting an authorization code. Follow the vendor's upgrade procedure carefully, including any database migrations or cache clearing. Test the OIDC login flow in a non-production environment before rolling out to production. After patching, revoke any active OIDC sessions in production to force re-authentication with the corrected validation logic.

Detection guidance

Log and alert on OIDC callback requests where the state parameter is missing, malformed, or does not match server-side records. Implement rate limiting on login endpoints to slow credential-stuffing or brute-force attempts. Monitor for logins from geographic regions inconsistent with user profiles or recent activity. Review Leantime access logs for sessions that immediately perform sensitive actions (data export, account changes) following a login. Correlate suspicious logins with corresponding OIDC provider logs if available to identify whether the authorization code originated from a legitimate or rogue client.

Why prioritize this

This vulnerability warrants immediate patching priority due to its high CVSS score (8.1), ease of exploitation, and direct impact on user account security. Session fixation attacks undermine the trust model of centralized authentication systems, and any delay in patching increases the window for attackers to compromise user accounts through phishing or other social engineering. The lack of privileged access requirements and minimal attack complexity mean threat actors can scale exploitation across multiple targets.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects a network-exploitable vulnerability with low attack complexity and no required privileges. User interaction is required, reducing the score below 'Critical' (9.0+), but the high impact on both confidentiality and integrity—achieved through session hijacking—drives the score into the HIGH band. The vulnerability does not affect availability, keeping the score below Critical. In context, this is a serious flaw that should not be deferred in patch planning.

Frequently asked questions