CVE-2026-59713— Leantime - OIDC Login CSRF via Unconditional State Verification Stub
Quick assessment
Affected
Leantime Leantime
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Leantime是Leantime公司开源的一个面向非项目经理的以目标为中心的项目管理系统。 Leantime 3.4.4及之前版本存在跨站请求伪造漏洞，该漏洞源于verifyState()方法中无条件返回true，未验证state参数，攻击者可构造含攻击者控制授权码的恶意回调URL，执行会话固定攻击，导致受害者登录为攻击者。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59713
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Leantime - OIDC Login CSRF via Unconditional State Verification Stub
Source: CVE Program / CVE List V5
Vulnerability Description
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Leantime 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Leantime是Leantime公司开源的一个面向非项目经理的以目标为中心的项目管理系统。 Leantime 3.4.4及之前版本存在跨站请求伪造漏洞，该漏洞源于verifyState()方法中无条件返回true，未验证state参数，攻击者可构造含攻击者控制授权码的恶意回调URL，执行会话固定攻击，导致受害者登录为攻击者。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-59713
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 6961 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-59713
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59713 (1)
Vendor Advisories for CVE-2026-59713 (1)
Proof of Concept for CVE-2026-59713 (1)
Other References for CVE-2026-59713 (1)
IV. Related Vulnerabilities
Same product: Leantime
-
CVE-2026-94211
Hyve5 Leantime Project Dashboard show.blade.php cross site s -
CVE-2026-94210
Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross -
CVE-2026-92772
Leantime before 3.9.6 Unauthorized Plugin Installation via H -
CVE-2026-54418
Leantime - Missing Authorization on TwoFA JSON-RPC Methods A -
CVE-2026-66416
Leantime CSRF Protection Globally Disabled by Omission of La
Same vendor: Leantime
-
CVE-2026-92772
Leantime before 3.9.6 Unauthorized Plugin Installation via H -
CVE-2026-76647
Leantime JSON-RPC API contains a missing authorization vulne -
CVE-2026-54418
Leantime - Missing Authorization on TwoFA JSON-RPC Methods A -
CVE-2026-66416
Leantime CSRF Protection Globally Disabled by Omission of La -
CVE-2026-66415
Leantime Server-Side Request Forgery and Local File Inclusio
Same weakness: CWE-352
-
CVE-2026-104407
WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Si -
CVE-2026-105292
Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callba -
CVE-2026-39718
WordPress Wallstreet theme <= 2.8.6 - Cross Site Request For -
CVE-2026-104452
YesWiki before 4.6.7 CSRF Attachment Deletion via filemanage -
CVE-2026-104453
YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
V. Comments for CVE-2026-59713
No comments yet