CVE-2025-66629 LOW

CVE-2025-66629: HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF

Vendor Hedgedoc

Product hedgedoc

Weakness CWE-352 · CSRF

Published December 5, 2025

Last update December 8, 2025

View on NVD All CVEs

CVSS base score

3.7/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.

Key dates

02Disclosure timeline

December 5, 2025 CVE published

December 8, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-66629 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

04Related CVE

CVE-2025-31570 WordPress Related Posts Widget with Thumbnails plugin <= 1.2 - CSRF to Stored XSS vulnerability CVE-2025-30572 WordPress Simple Rating plugin <= 1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability CVE-2020-7336 Network Security Management (NSM) - Cross Site Request Forgery vulnerability CVE-2023-51416 WordPress EnvíaloSimple plugin <= 2.2 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-28952 WordPress CubePoints plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability