{"id":"CVE-2026-34460","aliases":["EUVD-2026-33960","GHSA-pmpw-2xvh-5xj6"],"status":"published","title":"NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping","description":"NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00114,"percentile":0.01472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-302","CWE-346","CWE-352"],"published":"2026-06-02T15:29:14Z","modified":"2026-10-28T02:30:52Z","products":[{"vendor":"namelessmc","product":"nameless"}],"references":[{"url":"https://github.com/NamelessMC/Nameless/security/advisories/GHSA-pmpw-2xvh-5xj6","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34460.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34460","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34460","title":"NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping","description":"NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.","status":"published","published":"2026-06-02T15:29:14.648Z","modified":"2026-06-02T17:35:29.044Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-302","CWE-346","CWE-352"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-33960","description":"NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.","status":"published","published":"2026-06-02T15:29:14Z","modified":"2026-06-02T17:35:29Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:55.651138Z"}],"nvd":[{"id":"CVE-2026-34460","description":"NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.","status":"published","published":"2026-06-02T16:16:36.933Z","modified":"2026-07-22T19:10:00.12Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-302","CWE-346","CWE-352"],"updated_at":"2026-11-02T14:12:22.022466Z"}],"osv":[{"id":"CVE-2026-34460","title":"NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping","description":"NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.","status":"published","published":"2026-06-02T15:29:14.648Z","modified":"2026-10-28T02:30:52.151971812Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-302","CWE-346","CWE-352"],"updated_at":"2026-11-02T15:45:02.247031Z"}]}}