A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Tawk.to live chat application, affecting versions from 0.0.0 up to 3.0.4. This vulnerability allows attackers to trick authenticated users into submitting unauthorized requests. The issue has a medium severity with a CVSS score of 5.4.
A Cross-Site Request Forgery (CSRF) vulnerability exists in Electron prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6. The issue arises because Electron treated pages opened in new windows from links as application-initiated navigations rather than preserving the original page as the initiator. This caused SameSite=Strict cookies to be sent incorrectly, potentially allowing untrusted content to make credentialed requests to other sites relying on these cookies for CSRF protection. The vulnerability is fixed in the specified versions.
CVE-2026-114470 is a Cross-Site Request Forgery (CSRF) vulnerability in the REST API of Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It allows an attacker to cause an authenticated user's browser to perform state-changing actions such as creating domains, accounts, or API keys without the user's consent. The vulnerability arises because HTTP Basic authentication credentials are cached by the browser and automatically sent with cross-origin requests, bypassing protections that only cover cookie-based sessions. The attacker cannot read the response, making the attack blind.
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
CVE-2026-86467 is a Cross-Site Request Forgery (CSRF) vulnerability in the Apache Airflow Amazon provider's AWS authentication manager when using SAML login. The flaw allows an attacker to log a victim into the attacker's Airflow account by exploiting the lack of binding between the authentication response and the initiating browser session. This enables the attacker to hijack the victim's session without requiring any credentials. The issue affects versions prior to 9.38.0 and is fixed in that release.
@fastify/oauth2 versions 7.2.0 through 8.3.1 contain a Cross-Site Request Forgery (CSRF) vulnerability due to inconsistent cookie Path attributes for state and code-verifier cookies during OAuth2 login flows. This inconsistency allows the state cookie to persist beyond the OAuth callback, violating the single-use guarantee. An attacker who learns a valid state value can perform login CSRF by forcing the victim's browser to sign into the attacker’s account. The issue is fixed in version 8.3.2.
CVE-2026-84178 is a Cross-Site Request Forgery (CSRF) vulnerability in the Apache Camel OAuth component affecting versions from 4.11.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw allows an attacker to redeem an authorization code obtained in any browser at the callback, associating it with the victim's session, which can silently sign the victim in as the attacker-controlled identity. This also enables an open redirect from a trusted origin due to unvalidated post-authentication redirect targets. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1 and later.
CVE-2026-104627 is an improper authentication vulnerability in Gitea's OpenID association callback within security settings. The flaw allows an attacker-controlled OpenID provider to link the attacker's identity to a victim's account without the victim's initiation, enabling the attacker to sign in as the victim bypassing local two-factor authentication methods like TOTP or WebAuthn. The issue arises because OpenID 2.0 permits unsolicited assertions, and the callback did not verify that the signed-in user initiated the linking. The vulnerability affects Gitea versions up to 28.1.0. A fix has been implemented requiring a time-limited, user-bound 'state' value in the callback to prevent this attack.
A Server-Side Request Forgery (SSRF) vulnerability exists in the WP Data Access WordPress plugin before version 5.5.88. The flaw arises because one of the plugin's actions lacks authorization and CSRF protections, allowing any authenticated user, including low-privileged roles like subscribers, to make the server connect to arbitrary hosts and ports and read the response.
The Patreon WordPress plugin versions before 1.10.0 contain a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to trick a logged-in administrator into re-linking the site's Patreon integration to an attacker-controlled account via a crafted request. The vulnerability arises because the plugin does not verify a nonce during the connection process. Exploitation can lead to takeover of the site's Patreon integration.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the wpeverest User Registration & Membership WordPress plugin versions up to and including 5.2.8. The flaw arises from missing or incorrect nonce validation in the trigger_bulk_action function, allowing unauthenticated attackers to trick administrators into approving or denying user registrations. This can result in locking targeted users out of the site. The vulnerability bypasses earlier nonce checks by exploiting an empty new_role parameter, leading to unprotected execution of bulk actions.
OpenHuman versions before 0.56.0 are vulnerable to a cross-site request forgery (CSRF) attack on the unauthenticated GET /auth/telegram loopback callback. This flaw allows an attacker with an OpenHuman account to trick a user running the local core into switching their active session to the attacker's backend account, exposing sensitive agent actions, memory writes, and Telegram messages. The vulnerability is fixed in version 0.56.0.
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
A Cross-Site Request Forgery (CSRF) vulnerability exists in python-social-auth's social-core LINE backend prior to version 5.0.2. The vulnerability arises because the LINE backend exchanges an authorization code without validating the returned OAuth state parameter. This flaw allows an attacker to cause a victim to be logged into the attacker's LINE account or link the attacker's LINE identity to the victim's account when account linking is enabled. The issue is fixed in version 5.0.2.
CVE-2026-89279 is a Cross-Site Request Forgery (CSRF) vulnerability in AuthTake Technology Inc.'s authtake product. It affects versions from 1.3 up to but not including 1.4. The vulnerability allows an attacker to perform encryption brute forcing via CSRF attacks. The CVSS 3.1 base score is 6.5, indicating a medium severity level. No official patch or vendor advisory is provided in the available data.
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.
CVE-2026-84312 is an improper authentication vulnerability in the Casdoor SSO flow of 0xJacky nginx-ui. The OAuth state parameter is hard-coded and not validated against a per-session value, enabling login CSRF attacks. An attacker can force a victim's browser to authenticate as the attacker, potentially leading to unauthorized access and data exfiltration. The vulnerability affects versions prior to 2.4.1. A patch is available that implements proper state parameter generation and validation similar to the OIDC flow.
CVE-2026-59977 is a Cross-Site Request Forgery (CSRF) vulnerability in C4illin ConvertX, a self-hosted file conversion service. Versions prior to 0.18.0 have a /delete/{id} endpoint that uses HTTP GET for permanent deletion without CSRF protection. An authenticated user visiting attacker-controlled content can trigger deletion of converted-file history without authorization. This issue is fixed in version 0.18.0.
Progress Software Corporation MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 contain a Cross-Site Request Forgery (CSRF) vulnerability in the Query Console due to the use of predictable CSRF tokens. This flaw allows a remote attacker to trick an authenticated user into submitting unauthorized requests, potentially leading to execution of server-side code with the user's permissions.