Repository navigation
OAuth /rest/v1/callback continues after Flask session state mismatch (missing return) #1021
Description
Issue
What is the issue?
In callback(), oauthlib MismatchingStateError returns a redirect. The Flask session check does not:
if not session.get("state") or session.get("state") != request.args["state"]:
redirect(url_for("web.login")) # State does not match!
credentials = flow_instance.flow.credentials
# verify_oauth2_token + session["google_id"] still runThis is the cookie binding for “this browser started this login.” fetch_token still requires a valid Google code matching the Flow singleton. A forged state alone does not skip Google.
Expected Behaviour
Mismatched or missing Flask session["state"] redirects to login and does not set google_id / name / email.
Actual Behaviour
After a successful fetch_token, a mismatched Flask state still verifies the ID token and writes the session.
Steps to reproduce
Test client: mock CREFlow.fetch_token success and id_token.verify_oauth2_token. Set session["state"] = "victim-state", request /rest/v1/callback?state=attacker-state. Session still contains google_id and email.
Success criteria
-
return redirect(...)on Flask state mismatch. - Test: mismatch → no
google_id/emailin session;verify_oauth2_tokennot used to establish login. -
make lint/make mypy/make testgreen.
Activity
Ehtasham-Yasin commentedon Aug 25, 2026
Hi, I’d like to work on this issue. I’ll wait for maintainer acknowledgement before starting.
shiwani42 commentedon Aug 30, 2026
Hi @Ehtasham-Yasin, thank you for your interest!
I’ve worked on this issue locally and am waiting for the maintainers’ review before creating the PR.
@northdpole @Pa04rth
northdpole commentedon Sep 4, 2026
Maintainer triage (substance): confirmed real bug.
In
callback():Without
return, execution continues into token verification / session writes after a state mismatch.Acknowledged — open for a PR. Fix is
return redirect(...). Please also add a small unit/integration test if there is an existing OAuth test harness; otherwise a focused regression test is enough.fix(auth): return on OAuth state mismatch (OWASP#1021)
fix(auth): return on OAuth state mismatch (#1021)
northdpole commentedon Sep 4, 2026
Fixed in #1047 (
return redirect(...)on OAuth state mismatch in the canonical/rest/v1/auth/callback, which also covers the deprecated/rest/v1/callbackalias). Merged 2026-09-04.