Executive brief
@fastify/oauth2 is an OAuth 2.0 authentication plugin for the Fastify web framework. Versions 7.2.0 through 8.2.x contain a login CSRF vulnerability where an attacker can silently sign a victim into the attacker's account by planting matching OAuth state and verifier cookies from a related subdomain. This allows the attacker to record all victim activity under the attacker's account, though the victim's own credentials and tokens are not exposed.
Technical details
The vulnerability is a Cross-Site Request Forgery (CWE-352) affecting OAuth state validation. The plugin stores OAuth state and PKCE code_verifier in unprefixed cookies (oauth2-redirect-state, oauth2-code-verifier) that can be written by any sibling subdomain under the same registrable domain, and validates only that the callback query parameter matches the cookie value—not that the same browser initiated the flow. An attacker able to write cookies for the application's host (via XSS in a subdomain, subdomain takeover, or similar) can plant matching cookies and complete their OAuth flow in a victim's browser, achieving login CSRF. The attack requires user interaction and network access. The issue is fixed in version 8.3.0 with an opt-in hostPrefixedCookies flag that enables __Host- prefixed cookies, which browsers reject from related hosts.
Affected products
- OpenJS Foundation @fastify/oauth2 7.2.0 to 8.2.x
Timeline
- 2026-08-14: disclosed
- 2026-08-15: patched: Fix released in version 8.3.0 with opt-in hostPrefixedCookies option