OAuth2 State Desynchronization & Login CSRF Advisory

## Advisory Overview

During an architecture audit of modern OAuth2 / OIDC implementations, we documented widespread failures in binding authorization state tokens to the initiating browser session.

## Attack Vector

By tricking a victim into completing a malicious authorization flow, an attacker associates the victim session with attacker-controlled identity provider accounts.

## Defensive Fix

Bind the state parameter to an unreadable HttpOnly SameSite=Strict cookie with SHA-256 validation upon callback verification.