Is CVE-2026-59713 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-59713?

CVE-2026-59713 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-59713

Description

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.