Detections
Analytics

SCA: security update for fastapi-users (GHSA-5j53-63w8-8625)

high Tenable Self-Hosted Container Security Plugin ID 436451

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI
 project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-
 request entropy or any data that could link them to the session that initiated the OAuth flow.
 `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only
 contains the fixed audience claim plus an expiration timestamp. On callback, the library merely checks
 that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value
 to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. Any
 attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with
 their own provider account, and then trick a victim into loading
 `.../callback?code=<attacker_code>&state=<attacker_state>`. Because the state JWT is valid for any client
 for \~1 hour, the victim’s browser will complete the flow. This leads to login CSRF. Depending on the
 app’s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user
 getting logged in to the attacker's account. Version 15.0.2 contains a patch for the issue.
 (CVE-2025-68481)

See Also

https://github.com/advisories/GHSA-5j53-63w8-8625

Plugin Details

Severity: High

ID: 436451

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 12/20/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-68481

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/19/2025

Vulnerability Publication Date: 12/19/2025

Reference Information

CVE: CVE-2025-68481