This vulnerability (CVE-2025-31439) affects tobias_.MerZ Browser Caching with .htaccess version 1.2.1 and is classified as CWE-352 (Cross-Site Request Forgery). It allows an attacker to induce a user to perform unwanted actions on a web application in which they are authenticated. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. There is no vendor-provided patch or remediation level at this time.

Successful exploitation could allow an attacker to cause limited integrity and availability impacts by tricking authenticated users into submitting unauthorized requests. There is no confidentiality impact. The vulnerability requires user interaction and can be exploited remotely over the network without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as anti-CSRF tokens or verifying the origin of requests where possible. Monitor vendor channels for updates regarding patches or official mitigations.