CVE-2024-42476

Date: August 15, 2024

In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the "state" parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the "state" parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the "state" parameter using a regular "if" statement or "doAssert" instead of relying on a plain "assert". "doAssert" will achieve the desired behavior even if "-d:danger" or "--assertions:off" is set.

Language: NIM