WS-2024-0012

In vaultwarden before 1.33.0, an Attacker can create malicious html page that sends http request to the vaultwarden admin page for change. HTTP server doesn't verify Content-Type header. This requires the DISABLEADMINTOKEN option to be enabled, as the authentication cookie will not be sent across...