Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. (CVE-2026-96388)

The Drupal Tawk.to live chat application suffers from a CSRF vulnerability (CVE-2026-96388) that permits an attacker to induce an authenticated user to perform unintended actions via crafted requests. This affects all versions from the initial release (0.0.0) through 3.0.4. The vulnerability is characterized by low attack complexity, no privileges required, and requires user interaction. The impact includes limited confidentiality and integrity loss but no availability impact.

Successful exploitation could lead to unauthorized actions performed on behalf of an authenticated user, potentially compromising data confidentiality and integrity within the application context. There is no indication of availability impact or known active exploitation in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing CSRF protections such as anti-CSRF tokens or same-site cookies as a temporary mitigation.