PyPI/fastapi-sso CVE-2025-14546: medium 6.3, EPSS 0.36%

FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

Action: Upgrade fastapi-sso to 0.19.0 or later.

pip install fastapi-sso==0.19.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1362
• https://nvd.nist.gov/vuln/detail/CVE-2025-14546
• https://github.com/tomasvotava/fastapi-sso/issues/266
• https://github.com/tomasvotava/fastapi-sso/commit/6117d1a5ad498ba57d671e8a059ebe20db5abe02
• https://github.com/tomasvotava/fastapi-sso
• https://security.snyk.io/vuln/SNYK-PYTHON-FASTAPISSO-14386403
• https://pypi.org/project/fastapi-sso
• https://github.com/advisories/GHSA-hp6r-r9vc-q8wx

CVE-2025-14546 · published 2026-07-07T16:03:13.588483Z · modified 2026-07-07T17:47:35.987584320Z · JSON