Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:26.10 ruby-rodauth

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

参照URL

report ubuntu.com
report cve.org
report github.com
report github.com
report github.com
report vulncheck.com