Apache Juneau versions through 9.2.0 have a Cross-Site Request Forgery (CSRF) vulnerability. The REST server accepts a 'content' query parameter that replaces the request body and is enabled by default on all HTTP methods, including GET. This allows an attacker to craft a cross-site link that delivers an attacker-chosen request body without triggering CORS preflight checks, bypassing protections that rely on HTTP method or content type instead of anti-CSRF tokens. The issue is fixed in version 9.2.1. Users can also mitigate by disabling the content parameter if it is not used.