The vulnerability identified as CVE-2025-23884 is a CSRF issue in the Annie product by Chris Roberts, affecting versions up to and including 2.1.1. CSRF vulnerabilities enable attackers to induce users to perform actions they did not intend, leveraging the user's authenticated session. The CVSS v3.1 base score of 7.1 reflects a high severity with network attack vector, low complexity, no privileges required, user interaction needed, and scope changed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. There is no vendor advisory or patch information available at this time.

Successful exploitation of this CSRF vulnerability could allow attackers to perform unauthorized actions on behalf of authenticated users, potentially leading to partial loss of confidentiality, integrity, and availability of the affected system. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens or other mitigations at the application or network level where possible.