Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-59713
Description
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.
Leantime/leantime
GitHubLeantime is a goals focused project management system for non-project managers. Building with ADHD, Autism, and dyslexia in mind.
GitHubLeantime is a goals focused project management system for non-project managers. Building with ADHD, Autism, and dyslexia in mind.NVD