CVE-2025-14546: FastAPI SSP Vulnerable to CSRF via Improper OAuth Parameter Validation
Summary
CVE-2025-14546: Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. Affects fastapi-sso versions < 0.19.0. Fixed in 0.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FastAPI SSP is a Python package designed to facilitate Single Sign-On (SSO) authentication for FastAPI applications. It simplifies the integration of OAuth providers, allowing developers to implement secure authentication flows. However, prior to version 0.19.0, the package exhibited a critical vulnerability related to Cross-site Request Forgery (CSRF), stemming from inadequate validation of the OAuth state parameter during authentication callbacks.
Vulnerability Detail
The vulnerability arises from the failure to properly validate the OAuth state parameter in the authentication callback process. Although the get_login_url method generates a state, it does not persist this state or associate it with the user's session. As a result, the verify_and_process method accepts the state from query parameters without verifying it against a trusted local value. This oversight allows attackers to exploit the vulnerability by tricking victims into visiting malicious callback URLs, potentially linking the attacker's account to the victim's internal account.
How To Fix
Latest published version: 0.23.0 as of 23 Oct 2026
pip install --upgrade "fastapi-sso==0.23.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.19.0
This is the first release that contains the fix.
pip install --upgrade "fastapi-sso==0.19.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application implements additional checks on the OAuth state parameter before processing it. This can involve manually validating the state against a known value stored in the user's session or database.
Conclusion
The vulnerability identified as CVE-2025-14546 in the fastapi-sso package poses a significant risk due to improper validation of the OAuth state parameter, leading to potential CSRF attacks. It is crucial for developers to update to version 0.19.0 or later to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for fastapi-sso →
FAQ
CSRF is a type of attack that tricks a user into executing unwanted actions on a web application in which they are authenticated.
If you are using fastapi-sso version prior to 0.19.0, your application is vulnerable. You can check your application's dependencies using tools like Vulert.
An attacker could link their account to a victim's internal account, gaining unauthorized access to sensitive information or functionalities.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software without requiring access to the code.
The CVSS score for this vulnerability is 6.3, indicating a moderate level of risk.
