CVE-2025-67651 is a CSRF vulnerability in PHP Jabbers Appointment Scheduler where the absence of CSRF tokens or proper SameSite cookie attributes enables attackers to send unauthorized requests within the context of an authenticated user session. This can lead to unauthorized administrative actions such as creating new admin accounts. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). Although the description states that the issue was fixed in certain versions, no explicit affected versions or patch details are provided in the input data. No known exploits in the wild have been reported.

An attacker can exploit this vulnerability to perform unauthorized administrative actions, including creating new admin accounts, by tricking an authenticated user into submitting malicious requests. This can compromise the integrity and control of the affected Appointment Scheduler installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates that fixes exist in certain versions, so users should consult PHP Jabbers for official patches or updates. Until patched, users should consider implementing CSRF protections such as CSRF tokens and enforcing SameSite cookie attributes if possible.