Vulnerability · Published May 3, 2022 · Assigned by Logitech
CVE-2022-0916Broken authentication on Logitech Options due to misvalidation of Oauth state parameter
High 8.4
In plain English
A high-severity improper authentication in Options from Logitech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.4%top 60.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://support.logi.com/hc/en-us/articles/360025297893 x_refsource_MISC