CVE-2025-66629: CSRF in HedgeDoc

The CSRF vulnerability in HedgeDoc allows an attacker to craft malicious requests that appear to originate from a legitimate user. If a user is authenticated and visits a malicious website or clicks a crafted link, the attacker can potentially perform actions on their behalf, such as modifying notes or changing account settings. The impact is limited to actions that can be performed through the vulnerable OAuth2 endpoints for social login providers like Google, GitHub, GitLab, Facebook, and Dropbox. While the CVSS score is LOW, successful exploitation could lead to unauthorized data modification or account compromise, particularly if users have sensitive information stored within HedgeDoc.

1. Reserved2025-12-05
2. Published2025-12-05
3. Modified2025-12-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-66629 is to upgrade HedgeDoc to version 1.10.4 or later. This version includes a fix that properly implements CSRF protection for the affected OAuth2 endpoints. If upgrading immediately is not feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which HedgeDoc can load resources. Additionally, educate users about the risks of clicking suspicious links and visiting untrusted websites. After upgrading, verify the fix by attempting to trigger a CSRF request through a known vulnerable endpoint and confirming that the request is blocked.