The vulnerability in Leantime involves the verifyState() method used during OIDC login, which fails to validate the state parameter and unconditionally returns true. This improper validation allows attackers to perform session fixation by submitting crafted callback URLs containing attacker-controlled authorization codes. As a result, victims can be logged into the attacker's session, potentially leading to unauthorized access.

Successful exploitation allows an attacker to perform session fixation, causing victims to be logged into the attacker's session. This can lead to unauthorized access to the victim's account or data within Leantime. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery). No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious with OIDC login flows and consider additional validation or monitoring for suspicious login activity related to state parameters.