A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the Admin GUI of Payara Server Full versions 4.1.2.172 up to but not including 7.2026.6. This flaw allows an attacker to exfiltrate the administrator's REST session token (gfresttoken) by exploiting a Server-Side Request Forgery (SSRF) in the DownloadServlet combined with missing CSRF protections. An unauthenticated attacker can trick a logged-in administrator into leaking this token, which can then be replayed to gain full administrative access and deploy arbitrary code via WAR files. The issue affects multiple versions on all platforms and is fixed in version 7.2026.6.