Backdrop CMS contributed projects vulnerabilities and threats

CVE-2026-45430 is a high-severity vulnerability in the Salesforce module for Backdrop CMS contributed projects (backdrop-contrib/salesforce) prior to version 1.x-1.0.1. The module fails to properly implement a random state parameter in the OAuth authorization flow, leaving it vulnerable to Cross-Site Request Forgery (CSRF) attacks. This weakness could allow an attacker to trick a user into performing unwanted actions with high confidentiality and integrity impact, though availability impact is low. The vulnerability affects the cloud-hosted service version of the module. A patch is available to address this issue, and since it is a cloud service, the vendor typically manages remediation server-side. There are no known exploits in the wild at this time.