VYPR
← All advisories
Low severity3.7NVD Advisory· Published Dec 5, 2025· Updated Jun 17, 2026

CVE-2025-66629

CVE-2025-66629

Description

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • HedgeDoc/HedgeDoc3 versions
    cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*range: <1.10.4
    • (no CPE)range: <1.10.4
    • (no CPE)range: < 1.10.4

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.