Rule Explorer

Jupyter Server XSRF protection is disabled (disable_check_xsrf set to a truthy value). Disabling XSRF/CSRF checking removes the server's only protection against cross-site and unauthenticated state-changing requests. On tokenless deployments (no token or password configured) an anonymous client can create Jupyter kernels and send execute_request messages con

PythonCVE-2026-111058CWE-352CWE-502CWE-862

An authentication credential is derived from an external identity identifier (e.g. md5($data['id'])) and used to verify or provision a local account. The identifier is often public or guessable, so anyone can reproduce the credential and take over the account through the ordinary password login form. Provision federated accounts with a CSPRNG password, verif

PHPCVE-2026-109321CWE-288CWE-328CWE-352

The API credential $T is sourced from the browser-managed `token` cookie, an ambient credential channel, instead of being taken solely from the explicit Authorization header. Browsers attach cookies automatically to cross-site requests, so a cookie-sourced token authenticates CSRF against state-changing management APIs (CWE-352) and the shared token leaks vi

GoGinCVE-2026-107813

An authentication credential is built from a browser-ambient source (an HTTP cookie or a URL query parameter) and returned for request authentication. Browsers automatically attach cookies to cross-site requests, so every endpoint that trusts this token is vulnerable to cross-site request forgery (CWE-352): a remote attacker page can make a logged-in adminis

GoGinCVE-2026-107809CWE-352CWE-598

Request-controlled data reaches process execution without being resolved against a fixed allowlist. A caller (unauthenticated or cross-site/CSRF) supplies a command string that is tokenized into an argv list and executed (CVE-2026-107337 pattern: a raw URL segment is handed to the service() runner, split on spaces, joined under scripts/ and executed with sub

PythonFlaskCVE-2026-107337CWE-352CWE-78CWE-88

This request handler deserializes the incoming request with `$CLS.from_request(...)` (which builds the agent run input and leads to an agent run with tool execution) without validating the request Content-Type. Browsers can send cross-origin "simple" POSTs with CORS-safelisted Content-Types (text/plain, multipart/form-data, application/x-www-form-urlencoded)

PythonCVE-2026-107295CWE-352CWE-502

Destructive delete reachable from a plain GET request: this code path is entered only because a GET/REQUEST parameter is present, and no CSRF token validation or HTTP-method restriction protects the enclosing scope. Authorization relies solely on the ambient session cookie, so a cross-site auto-issuing GET (<img>/<script> src, link, redirect) from a logged-i

PHPCVE-2026-104448CWE-352

Calling loginFromRequestIfNotLogged() followed by isLogged() without verifying whether the session already existed allows CSRF bypass: an attacker supplying arbitrary credentials alongside a victim's session cookie satisfies the isLogged() check without validating the request credentials.

PHPCVE-2026-92582CWE-287CWE-352

CSRF-able destructive operation: $OBJ is constructed directly from a request parameter ($_POST/$_GET/$_REQUEST) and then destroyed with $OBJ->delete()/$OBJ->remove(), with no CSRF token validation performed first. Ambient session-cookie authentication alone protects this handler, so a cross-site form POST from an attacker page carries the victim's cookies an

PHPCVE-2026-89245CWE-352

CSRF (CWE-352): a PGP 2FA public-key mutation ($CLASS::$METHOD / $OBJ->$METHOD, e.g. LoginControl::setPGPKey) is protected only by ambient cookie-based session authentication. No anti-CSRF token validation is executed between the authentication guard and the key mutation, so a forged cross-site GET/POST carrying the victim's session cookie can silently repla

PHPCVE-2026-88870CWE-352

User session swapping or cancellation is performed without enforcing POST request method or validating a CSRF token. This permits cross-site request forgery (CSRF) via cross-origin requests.

PHPCVE-2026-86719CWE-352

A nonce generated with `wp_create_nonce()` is validated against `wp_verify_nonce()` in the same context instead of verifying the nonce supplied in the request. This causes the verification to always succeed, bypassing authentication and CSRF protections.

PHPCVE-2026-84760CWE-352CWE-862

Jenkins Stapler web action method performs cache clearing or deletion without `@RequirePOST` or `@POST`. State-modifying endpoints accessible via HTTP GET are vulnerable to Cross-Site Request Forgery (CSRF).

JavaCVE-2026-84663CWE-352

CSRF token (crumb) obtained via issueCrumb() is directly concatenated or embedded into a JavaScript proxy or script template. This allows same-site attackers to extract the victim's CSRF crumb from generated script resources. Use getCrumbExpression() instead.

JavaCVE-2026-84649CWE-200CWE-352

Same-site/origin decision is made by comparing two results of the same domain/host extraction helper ($F) without first rejecting parser failure. Such helpers return false/null/"" for hosts they cannot parse (long gTLDs, IPv6 literals, missing host), so two unrelated or attacker-chosen origins can satisfy "false === false" and the CSRF/Referer authenticity g

PHPCVE-2026-84482CWE-346CWE-352

OAuth callback exchanges the authorization code for a token using a client-supplied state ($STATE) that is never validated against a value bound to the initiating browser session. The state parameter is the CSRF boundary of the authorization-code flow: when it is taken from the request (a bound struct field or a query/form parameter) and passed to the token

GoGinCVE-2026-84312CWE-345CWE-352

State-changing API action is executed while same-domain checks are explicitly bypassed without validating the HTTP request method or request origin, leading to CSRF.

PHPCVE-2026-83595CWE-352

Endpoint 'sendEmail.json.php' is included in CSRF bypass list, allowing cross-site request forgery when authenticated administrators visit malicious sites.

PHPCVE-2026-82647CWE-352

The 'netmount' command is omitted from $csrfProtectedCmds in elFinderConnector, allowing cross-site requests to perform network mount operations without CSRF token validation (CVE-2026-81890).

PHPCVE-2026-81890CWE-352

Validating REST API routes using $_SERVER['REQUEST_URI'] when handling 'rest_cookie_invalid_nonce' errors can allow CSRF protection bypass via query parameter injection.

PHPCVE-2026-81271CWE-352

A handler that iterates user-controlled array keys from $_POST/$_GET/$_REQUEST and issues an outbound HTTP/API request with a dynamic URL path does not verify a nonce/capability nor validate the key against a server-side allowlist. PHP preserves '/', '..' and '?' in request array keys, so a key such as "../../routes?x" is interpolated into a relative URL pat

PHPCVE-2026-78003CWE-352CWE-862CWE-918

State, CSRF token, or nonce validation function returns :ok in a fallback clause where request parameters are ignored. This allows attackers to bypass validation by omitting required request parameters. Return {:error, ...} instead.

ElixirCVE-2026-66884CWE-352

A CSRF/OAuth `state` token read from the request query is validated by a direct ==/!= comparison against a value taken from a session Values map. Query accessors (net/url Values.Get, echo QueryParam) return "" for both a missing and an empty parameter, so replaying the callback with ?state= (or with no state at all) makes both operands "" whenever the stored

GoCVE-2026-61687CWE-20CWE-352

SSE or LiveView endpoint is marked @csrf_exempt but does not validate the request Origin header or enforce Content-Type. This allows cross-origin requests to forge state-changing events in authenticated victim sessions (CSRF).

PythonCVE-2026-61593CWE-352