Rclone versions from 1.52.0 up to but not including 1.75.2 contain a cross-site request forgery (CSRF) vulnerability in the pCloud backend's localhost OAuth callback. This flaw disables the state check and trusts the hostname parameter, allowing malicious web pages to send unauthorized requests to the local OAuth callback port. As a result, attacker tokens and API hosts can be planted, causing subsequent transfers to be redirected to the attacker.