CVE-2026-48767: Unverified Oauth State Base64 Json Parse
OAuth state parameters are parsed directly from unauthenticated base64 JSON without cryptographic signature or nonce verification. An attacker can tamper with state fields to bypass authorization checks or conduct CSRF attacks.
TSgreprules fetch cve-2026-48767-unverified-oauth-state-base64-json-parse --engine opengrepDescription
OAuth state parameters are parsed directly from unauthenticated base64 JSON without cryptographic signature or nonce verification. An attacker can tamper with state fields to bypass authorization checks or conduct CSRF attacks.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.