CVE-2023-29020

CVE-2023-29020 is a Cross-Site Request Forgery (CSRF) bypass vulnerability affecting @fastify/passport when used with @fastify/csrf-protection. The flaw allows network and same-site attackers to obtain a valid CSRF token from a pre-login session, fixate that session, and then execute CSRF attacks after the victim authenticates due to the session object not being cleared upon login. Rated as MEDIUM severity with a CVSS score of 6.5, this vulnerability has a network attack vector, low attack complexity, and high impact on integrity, requiring user interaction. The primary cause is improper session management, specifically the preservation of the _csrf attribute between pre-login and authenticated sessions. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Organizations are advised to update @fastify/passport to versions that include the clearSessionOnLogin configuration option to mitigate this risk.