CVE-2026-33920

Katalog CVE

CVSS 3.5 · Low EPSS 0,13%

Kerentanan Cross-Site Request Forgery (CSRF). Skor CVSS 3.1 3.5 (Low) menurut nozominetworks.com.

Deskripsi (NVD)

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.

Rincian

Terbit di NVD

8 September 2026

Terakhir diubah

8 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

3.5 (Low), sumber nozominetworks.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://security.nozominetworks.com/NN-2026:18-01