CVE-2026-77058

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

CVE-2026-77058

boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints. The root cause is the absence of CSRF tokens and a failure to validate Origin or Referer headers. A remote attacker can lure a user on the internal network to a malicious webpage that sends cross-...