CVE-2026-59713 Leantime CVE debrief

Who should care

Users of Leantime should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating Leantime to the latest version, implementing additional security measures to prevent CSRF attacks, and monitoring for suspicious activity. The vulnerability has a CVSS score of 8.6 and is classified as HIGH.

Technical summary

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker. The vulnerability has a CVSS score of 8.6 and is classified as HIGH. The CVE record was published on 2026-07-06T21:16:58.930Z and has not been modified since then. The NVD entry is currently Deferred.

Defensive priority

High

Recommended defensive actions

• Review and update Leantime to the latest version
• Implement additional security measures to prevent CSRF attacks
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-06T21:16:58.930Z and has not been modified since then. The NVD entry is currently Deferred. The vulnerability has a CVSS score of 8.6 and is classified as HIGH. The CVE record and NVD entry provide limited information about the vulnerability, and defenders should verify the affected scope and severity with the vendor.

Official resources