CVE-2026-49455: CWE-352: Cross-Site Request Forgery (CSRF) in wakujs waku
Description
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. This issue has been patched in version 1.0.0-beta.1.
CVSS v3.1
Score 6.5medium
Affected software
wakujs
waku
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Waku versions before 1.0.0-beta.1 have a CSRF vulnerability due to the RSC request dispatcher invoking server actions without validating the Origin or Sec-Fetch-Site headers. This allows a cross-origin attacker to cause a victim's browser to send authenticated POST requests to server action endpoints using a CORS-safelisted content type (text/plain), which bypasses preflight checks. Any state-mutating server action exposed via 'use server' can be invoked with the victim's cookies, potentially leading to unauthorized state changes. The vulnerability is fixed in version 1.0.0-beta.1.
Potential Impact
An attacker can exploit this vulnerability to perform unauthorized state-changing actions on behalf of an authenticated user by leveraging the victim's browser and cookies. This can lead to integrity violations of the affected application without requiring user interaction beyond visiting a malicious site. Confidentiality and availability are not impacted according to the CVSS vector.
Mitigation Recommendations
Upgrade to Waku version 1.0.0-beta.1 or later, where this CSRF vulnerability has been patched. No other mitigation is indicated by the vendor advisory or data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-30T02:43:33.107Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a99be83acd9273b494fd174
Added to database: 09/03/2026, 18:37:55 UTC
Last enriched: 09/07/2026, 12:54:46 UTC
Last updated: 10/18/2026, 18:48:21 UTC
Views: 92
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.