CVE-2025-47909

The TrustedOrigins component implicitly allows requests from corresponding HTTP origins, creating a vulnerability where network MitM attackers can perform CSRF attacks . While a previous fix for CVE-2025-24358 prevents form submissions from HTTP origins to HTTPS origins when the Origin header is ...