OAuth State Parameter Missing
OAuth authorization flow implemented without a random `state` parameter, allowing CSRF attacks that link a victim's account to the attacker's OAuth identity.
How It Works
The OAuth `state` parameter is a random value you generate, include in the authorization URL, and verify when the callback returns. Without it, an attacker can initiate an OAuth flow, get the callback URL (before completing login), and send it to a victim. The victim clicks it, completes OAuth, and their account is now linked to the attacker's social identity.
// BAD: OAuth redirect without state
export async function GET() {
const authUrl = `https://github.com/login/oauth/authorize?client_id=${CLIENT_ID}&scope=user`;
return Response.redirect(authUrl);
}// GOOD: generate and verify state parameter
export async function GET(req: Request) {
const state = crypto.randomUUID();
// Store state in session to verify later
const session = await getSession();
session.oauthState = state;
await session.save();
const authUrl = `https://github.com/login/oauth/authorize?client_id=${CLIENT_ID}&state=${state}&scope=user`;
return Response.redirect(authUrl);
}Real-World Example
Facebook, Twitter, and GitHub OAuth implementations in third-party apps have all had state-parameter-missing vulnerabilities reported. Successful exploitation means an attacker can link their GitHub account to a victim's app account, gaining access.
How to Prevent It
- Always generate a cryptographically random state parameter (use crypto.randomUUID() or nanoid)
- Store the state in the user's session before redirecting to the OAuth provider
- On callback, verify the returned state matches the stored state exactly
- Use an OAuth library (next-auth, passport.js) that handles state management for you
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Session Fixation
highThe server reuses the same session ID before and after login, allowing an attacker who planted a known session ID to hijack the authenticated session.
No Account Lockout / Brute Force Protection
mediumLogin endpoints with no rate limiting or lockout mechanism, allowing attackers to try unlimited username and password combinations until they find valid credentials.
Weak Password Policy
mediumNo minimum length, complexity, or common-password requirements on registration or password change, making user accounts easily brute-forced or guessed.
Token Not Invalidated on Logout
mediumJWT or session tokens remain valid after a user logs out because there is no server-side revocation mechanism, allowing stolen tokens to be used indefinitely.