CVE-2026-34460
Description
NamelessMC versions prior to 2.2.5 suffer from an OAuth login CSRF vulnerability, allowing attackers to swap victim sessions to attacker-linked accounts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
NamelessMC versions prior to 2.2.5 suffer from an OAuth login CSRF vulnerability, allowing attackers to swap victim sessions to attacker-linked accounts.
Vulnerability
NamelessMC versions 2.2.4 and prior are affected by a vulnerability in their OAuth callback handling. The software fails to validate the state parameter server-side before exchanging an authorization code. This flaw exists in files like core/classes/Misc/NamelessOAuth.php and modules/Core/pages/oauth.php [1].
Exploitation
An attacker can obtain a valid OAuth callback URL associated with their own account. By tricking a victim into navigating to this URL, the attacker can exploit the missing server-side validation of the state parameter. If the victim has an active session that initiated an OAuth login, their session can be hijacked [1].
Impact
Successful exploitation allows an attacker to cause a victim's browser session to be authenticated as the attacker-linked account. This is a form of session swapping or OAuth login CSRF, where the victim unintentionally logs into an account controlled by the attacker, rather than their own [1].
Mitigation
This vulnerability is fixed in NamelessMC version 2.2.5. Users should update to this version or later to address the issue [1].
AI Insight generated on Jun 2, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: <=2.2.4
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code."
Attack vector
An attacker can craft a malicious OAuth callback URL containing their own account's state parameter. By tricking a victim into visiting this URL, the attacker can cause the victim's browser session to be authenticated as the attacker-linked account. This occurs because the application does not verify that the returned state parameter matches a server-side value previously generated for the user's session [ref_id=1]. The vulnerability is described as OAuth login CSRF or session swapping [ref_id=1].
Affected code
The vulnerability lies within the OAuth callback handling logic. Specifically, the application accepts OAuth callback requests based on provider and code but fails to verify the returned state parameter against a server-side stored value. The relevant code locations identified are core/classes/Misc/NamelessOAuth.php and modules/Core/pages/oauth.php [ref_id=1].
What the fix does
The patch addresses the vulnerability by implementing server-side validation of the OAuth state parameter. The application will now generate a cryptographically random state value per authorization request and store it server-side within the user's session. Upon receiving a callback, the application will compare the provided state parameter against the stored session value, rejecting the callback if they do not match. The stored state is then cleared after processing [ref_id=1].
Preconditions
- configNamelessMC instance must have OAuth configured, for example, with Discord [ref_id=1].
- authThe attacker must be able to create a NamelessMC account linked to an attacker-controlled Discord account [ref_id=1].
- inputThe attacker needs to intercept and capture a valid OAuth callback URL during the login process initiated by the victim [ref_id=1].
Reproduction
1. Configure Discord OAuth for the NamelessMC instance. 2. Create a NamelessMC account linked to an attacker-controlled Discord account. 3. In an attacker browser session, initiate the 'Login with Discord' flow. 4. Intercept the final OAuth callback request (e.g., GET /index.php?route=%2Foauth%2F&provider=discord&code=<attacker_code>&state=<attacker_state>) before it reaches the application and do not forward it. 5. In a victim browser session, visit /login to create a login-related OAuth session state. 6. In the victim's browser, navigate to the attacker-captured callback URL. 7. Observe that the victim session is logged into the attacker-linked NamelessMC account [ref_id=1].
Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.