CVE-2024-42476

In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the state parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the state parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the state parameter using a regular if statement or doAssert instead of relying on a plain assert. doAssert will achieve the desired behavior even if -d:danger or --assertions:off is set.

In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the state parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the state parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the state parameter using a regular if statement or doAssert instead of relying on a plain assert. doAssert will achieve the desired behavior even if -d:danger or --assertions:off is set.

In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the state parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the state parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the state parameter using a regular if statement or doAssert instead of relying on a plain assert. doAssert will achieve the desired behavior even if -d:danger or --assertions:off is set.

In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the state parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the state parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the state parameter using a regular if statement or doAssert instead of relying on a plain assert. doAssert will achieve the desired behavior even if -d:danger or --assertions:off is set.