CVE-2025-66629: 
NixOS vulnerability analysis and mitigation

CVE-2025-66629 is a Cross-Site Request Forgery (CSRF) vulnerability in HedgeDoc's OAuth2 social login endpoints. Prior to version 1.10.4, HedgeDoc failed to send or validate the OAuth2 state parameter for social login providers including Google, GitHub, GitLab, Facebook, Dropbox, and Mattermost, leaving these flows unprotected against CSRF attacks. The vulnerability was disclosed on December 5, 2025, and patched in version 1.10.4. It carries a CVSS v3.1 base score of 3.7 (Low) per the GitHub advisory, or 4.3 (Medium) per NVD (GitHub Advisory, Red Hat CVE).

The root cause is CWE-352 (Cross-Site Request Forgery): HedgeDoc's Passport.js-based OAuth2 strategies for GitHub, GitLab, Google, Facebook, Dropbox, and Mattermost were initialized without the state: true option, meaning no random CSRF token was generated, stored in the user's session, or verified upon callback. Per the OAuth 2.0 specification (RFC 6749, Section 10.12), clients MUST implement CSRF protection via the state parameter. An attacker can exploit this by crafting a malicious URL such as https://hedgedoc.example.com/auth/gitlab/callback?code=<attacker_auth_code> and tricking a victim into visiting it, causing the victim's session to be authenticated as the attacker's account. The fix (commit 35f36fcc) added state: true and PKCE support to all affected provider strategies (GitHub Advisory, Patch Commit).

If exploited, an attacker can inject their own OAuth2 authorization code into a victim's session, causing the victim to be logged into the attacker's account (account login CSRF). If the victim does not notice the account switch, any notes they create will be accessible to the attacker, potentially exposing sensitive information. There is no direct availability impact, but confidentiality and integrity are both at risk through unauthorized account linkage and data exposure (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date. The vulnerability requires user interaction — a victim must be tricked into clicking a crafted callback URL — and the attacker must already possess a valid authorization code for their own account on the configured OAuth2 provider. The EPSS score is approximately 0.014% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat CVE).

1. Identify a target HedgeDoc instance: Confirm the instance is running a version prior to 1.10.4 and has at least one social OAuth2 provider (Google, GitHub, GitLab, Facebook, Dropbox, or Mattermost) enabled.
2. Obtain an attacker-controlled authorization code: Initiate a legitimate OAuth2 login flow on the target HedgeDoc instance using the attacker's own account with the enabled provider, and capture the code parameter returned to the callback URL.
3. Craft a malicious callback URL: Construct a URL targeting the victim's HedgeDoc instance callback endpoint with the attacker's authorization code, e.g., https://hedgedoc.example.com/auth/gitlab/callback?code=<attacker_code>.
4. Deliver the URL to the victim: Use phishing, a malicious link, or an embedded resource to trick the victim into visiting the crafted URL while they have an active browser session.
5. Account takeover via session swap: Because no state parameter is validated, HedgeDoc processes the attacker's authorization code and logs the victim's session into the attacker's account. Any notes subsequently created by the victim are accessible to the attacker (GitHub Advisory).

• Logs: HedgeDoc authentication logs showing OAuth2 callback requests (/auth/github/callback, /auth/gitlab/callback, /auth/google/callback, /auth/facebook/callback, /auth/dropbox/callback) that lack a state query parameter, or where the state value does not match any active session.
• Logs: Multiple callback requests from different IP addresses using the same code parameter value, indicating code injection attempts.
• Behavioral: Users reporting unexpected account switches or finding themselves logged into an unfamiliar account after clicking a link.
• Network: Unusual referrer headers or direct navigation (no referrer) to OAuth2 callback endpoints, which would be atypical for a legitimate OAuth2 flow initiated by the user (GitHub Advisory).

Upgrade HedgeDoc to version 1.10.4 or later, which adds state: true and PKCE support to all affected OAuth2 provider strategies (commit 35f36fcc). As a temporary workaround, administrators can disable the affected social login providers (Google, GitHub, GitLab, Facebook, Dropbox, Mattermost) until the upgrade is applied, though this may disrupt users who rely on these authentication methods. Additionally, monitoring OAuth2 authentication logs for anomalous callback requests is recommended (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher @StefanRecurityLabs and disclosed via GitHub's security advisory process on December 5, 2025. The advisory was rated Low severity by the HedgeDoc maintainers. No significant broader media coverage or notable community debate has been identified beyond standard CVE tracking and aggregation sites (GitHub Advisory).