CVE-2026-63433

The self-hosted video downloader and player MyTube is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.10.6 . The root cause is located in backend/src/middleware/csrfConfig.ts, where the shouldSkipCsrfProtection() function incorrectly grants a CSRF exemption by chec...

Echo Has CSRF Protection Bypass Via MethodOverride Rewriting POST To Safe Method

Summary The "MethodOverride" middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When "MethodOverride" is registered before "CSRF" in the post-routing middleware chain "e.Use", it rewrites the...

GHSA-R7W9-592Q-9VG4 Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Summary The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain e.Use, it rewrites the request...

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Summary The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain e.Use, it rewrites the request...

CVE-2026-118266 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

CVE-2026-118266

The Echo Go web framework is vulnerable to a CSRF protection bypass in versions prior to 4.16.0 and 5.4.0 . The flaw exists because the MethodOverride middleware allows a POST request to be rewritten to a safe HTTP method. If MethodOverride is registered before CSRF middleware, the route selectio...

CVE-2026-118266 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

CVE-2026-54510

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...

PT-2026-95103

Name of the Vulnerable Software and Affected Versions Speakr versions prior to 0.8.21-alpha Description An issue exists where the csrf exempt for api tokens before request hook in src/app.py calls csrf.exemptview func, which permanently adds the selected view to the process-global exemption set o...

EUVD-2026-70487

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-81888

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the "state" value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

UBUNTU-CVE-2026-82468

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

CVE-2026-82468

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

EUVD-2026-57326

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

CVE-2026-15747

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. csrftoken generates and caches one token per session and returns the same value on every call, and csrffield places that value in a hidden csrftoken input...

CVE-2026-41255

CKAN is an open-source DMS data management system for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect,...

CVE-2026-28508

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoin...

GHSA-58C5-G7WP-6W37 Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery XSRF token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol...