Vulnerability Details CVE-2025-66629
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 1.8%
CVSS Severity
CVSS v3 Score 3.7
References
Products affected by CVE-2025-66629
-
cpe:2.3:a:hedgedoc:hedgedoc:-
-
cpe:2.3:a:hedgedoc:hedgedoc:0.3.3
-
cpe:2.3:a:hedgedoc:hedgedoc:0.3.4
-
cpe:2.3:a:hedgedoc:hedgedoc:0.4.0
-
cpe:2.3:a:hedgedoc:hedgedoc:0.4.1
-
cpe:2.3:a:hedgedoc:hedgedoc:0.4.2
-
cpe:2.3:a:hedgedoc:hedgedoc:0.4.3
-
cpe:2.3:a:hedgedoc:hedgedoc:0.4.4
-
cpe:2.3:a:hedgedoc:hedgedoc:0.4.5
-
cpe:2.3:a:hedgedoc:hedgedoc:0.4.6
-
cpe:2.3:a:hedgedoc:hedgedoc:0.5.0
-
cpe:2.3:a:hedgedoc:hedgedoc:0.5.1
-
cpe:2.3:a:hedgedoc:hedgedoc:1.10.0
-
cpe:2.3:a:hedgedoc:hedgedoc:1.10.3
-
cpe:2.3:a:hedgedoc:hedgedoc:1.2.0
-
cpe:2.3:a:hedgedoc:hedgedoc:1.2.1
-
cpe:2.3:a:hedgedoc:hedgedoc:1.3.0
-
cpe:2.3:a:hedgedoc:hedgedoc:1.3.1
-
cpe:2.3:a:hedgedoc:hedgedoc:1.3.2
-
cpe:2.3:a:hedgedoc:hedgedoc:1.4.0
-
cpe:2.3:a:hedgedoc:hedgedoc:1.5.0
-
cpe:2.3:a:hedgedoc:hedgedoc:1.6.0
-
cpe:2.3:a:hedgedoc:hedgedoc:1.7.0
-
cpe:2.3:a:hedgedoc:hedgedoc:1.7.1
-
cpe:2.3:a:hedgedoc:hedgedoc:1.7.2
-
cpe:2.3:a:hedgedoc:hedgedoc:1.8.0
-
cpe:2.3:a:hedgedoc:hedgedoc:1.8.1
-
cpe:2.3:a:hedgedoc:hedgedoc:1.8.2
-
cpe:2.3:a:hedgedoc:hedgedoc:1.9.1
-
cpe:2.3:a:hedgedoc:hedgedoc:1.9.2
-
cpe:2.3:a:hedgedoc:hedgedoc:1.9.3