Hi New Relic security team, While doing pentesting on your website, I found that while logging into the account the "authenticity_token" was not properly validated. I was able to login into my account even without "authenticity_token". Impact: High Steps to Reproduce: 1) Login to your account. 2) While logging in make sure that the intercept is on in your burp suite. 3) In burp suite, you can view the request you made after clicking on sign in. 4) In the request, you'll find the "authenticity_token" parameter. 5) Now, remove the value which is there in the "authenticity_token" parameter. 6) And now forward the packet and off the interception in burp suite. 7) Now, you'll successfully able to login without CSRF or authenticity_token. PoC: 1) Copy the below code to the notepad and save it in the .html format. 2) Send this file to the victim and when the victim clicks on submit button in the victims browser, the victim will now be able to login with the attackers login credentials. 3) And after that an attacker can later log into the site with his/her legitimate credentials and view private information like activity history of the victim that has been saved in the account. Mitigation: Please refer the following link: https://www.owasp.org/index.php/CSRF_Prevention_Cheat_Sheet Thank you, Praseudo