CVE-2026-83595: Cross-Site Request Forgery (CSRF)

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

CVE-2026-81888

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81890

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...

GHSA-FM3F-CH8H-QW8Q @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...

CVE-2026-54599 Wallos: OIDC state parameter never validated — login CSRF / account takeover

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $SESSION'oidcstate', but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can...

CVE-2026-54599

Wallos , an open-source self-hostable personal subscription tracker, is vulnerable to login CSRF / account takeover prior to version 4.9.4 . The root cause is that login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without ...

CVE-2026-54599 Wallos: OIDC state parameter never validated — login CSRF / account takeover

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $SESSION'oidcstate', but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can...

CVE-2026-54599 Wallos: OIDC state parameter never validated — login CSRF / account takeover

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $SESSION'oidcstate', but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can...

CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

CVE-2026-81890

elFinder (an open-source web file manager built on jQuery UI) prior to 2.1.70 is vulnerable to a CSRF flaw in the netmount command. The command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is never invoked for this state-changing...

CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

EUVD-2026-68770

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888

@hono/oauth-providers , authentication middleware for the Hono web framework, has a flaw in its OAuth state validation. Prior to version 0.8.6 , the built-in social login providers accept an OAuth callback even when the state value is absent on both the expected and received sides, causing the an...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

Cross-site Request Forgery (CSRF)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CVE-2026-71378

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...