Security fix
This release fixes an OAuth login CSRF vulnerability affecting OAuth providers that did not validate the state parameter during the authorization callback.
Affected applications could accept an authorization code initiated by an attacker and execute onSuccess in a victim’s browser session. Depending on the application, this could result in forced authentication or unintended account linking.
OAuth and OpenID handlers now bind callbacks to the browser session that initiated authentication by consistently generating, storing, and validating a one-time state value. Existing PKCE protections remain in place.
We recommend upgrading to nuxt-auth-utils@0.5.30.
See GHSA-xc49-mgwh-9pjv for details.
Thanks to @onevilx for responsibly reporting this vulnerability.