This vulnerability in Mojolicious affects versions from 4.59 before 9.48 for Perl. The _csrf_token method generates a single token per session that is reused and placed in a hidden input field by _csrf_field. When responses containing this token also echo attacker-controlled input and are gzip-compressed, the compression length variations can be used as a BREACH oracle to recover the CSRF token. An attacker who can query such responses can extract the token and bypass csrf_protect validation, potentially enabling cross-site request forgery attacks.

An attacker able to send requests that cause the server to respond with gzip-compressed content containing both the CSRF token and attacker-controlled input can exploit compression side-channel attacks (BREACH) to recover the CSRF token. This allows the attacker to bypass CSRF protections, increasing the risk of unauthorized actions performed on behalf of authenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Until a fix is available, consider disabling gzip compression on responses that include CSRF tokens or avoid reflecting attacker-controlled input in such responses to mitigate the risk.