NamelessMC website software for Minecraft servers versions prior to 2.2.5 improperly handle the OAuth callback by not validating the state parameter server-side before exchanging the authorization code. This flaw allows an attacker to capture a valid OAuth callback URL tied to their own account and induce a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker's account. This is a form of authentication bypass due to assumed-immutable data, categorized under CWE-302, CWE-346, and CWE-352. The vulnerability is patched in version 2.2.5.

An attacker can cause a victim to be logged in as the attacker by exploiting the OAuth callback handling flaw, leading to session swapping or OAuth login CSRF. This compromises the integrity of user sessions but does not directly result in denial of service or data confidentiality loss beyond the affected session. No known exploits are reported in the wild.

Upgrade NamelessMC to version 2.2.5 or later, where the OAuth callback state parameter validation is properly implemented. No other mitigations are specified or required once patched.