vulns.co
/
mcp by GKData.io

Back to Gadgets

CSRF without a real origin check

Cookie-authenticated change of email, password, OAuth link, payment method, or role that does not bind Origin / Referer / a CSRF token the browser cannot set. Inventory it. It becomes ATO when the action is identity-shaped.

Tags: csrf, ato, session, samesite

Typical severity: P2-P4

What it becomes

State-changing cookie-auth requests that accept a cross-site POST become account or billing actions. JSON plus a missing CORS preflight is the modern shape.

Where to look

  • email change
  • password change
  • OAuth connect
  • disable MFA
  • invite accept
  • API keys
  • webhooks

Chains

  • Account takeover: Change the victim's email or OAuth link from an attacker page, then reset.
  • Privilege escalation: Invite-accept or role-grant endpoints that only check the session cookie.
  • Integrity / money: Payout account, subscription, or transfer POSTs with SameSite=None or a subdomain cookie.

Notes

  • SameSite=Lax blocks classic cross-site POST in modern Chrome. Subdomains, top-level GET, and client-initiated fetches with cookies still matter.
  • Do not fire the action against a real victim. Two accounts you own, or a dry-run that only proves the missing check.

Back to Gadgets