Mojolicious, a Perl real-time web framework, versions before 9.48 reuse an unchanged per-session CSRF token in rendered HTML via the csrf_field, csrf_token, and csrf_protect helpers. When response compression is enabled and attacker-influenced content is reflected in the same HTTP response, an unauthenticated attacker capable of inducing multiple victim requests and observing response sizes can exploit the BREACH compression side channel to recover the CSRF token. This exposure allows the attacker to forge cross-site requests. Deployments that do not render the token in HTML (API-only) are not vulnerable. The vulnerability is addressed in Mojolicious version 9.48.

An unauthenticated attacker can recover CSRF tokens by exploiting a compression side channel (BREACH) when response compression is enabled and attacker-controlled content is reflected. This enables the attacker to forge cross-site requests, potentially leading to unauthorized actions on behalf of victims. The impact is limited to confidentiality and integrity of CSRF tokens, with no availability impact reported.

Upgrade Mojolicious to version 9.48 or later, where this issue is fixed. If upgrading is not immediately possible, consider disabling response compression or ensuring that attacker-controlled content is not reflected in responses containing CSRF tokens. API-only deployments that do not render CSRF tokens in HTML are not affected and require no action.