Description
Summary
Server functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests.
Recommendation
Update the rwsdk package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0-beta.50, <= 1.0.5
- Patched version(s): 1.0.6
References
Could your website be exposed too?
SmartScanner can check your website for RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests and gives you actionable findings to investigate.
Start a free scanRelated Issues
- RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions - CVE-2026-42190
- @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints - CVE-2026-53513
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- React Router: Potential CSRF via PUT/PATCH/DELETE document requests - CVE-2026-53663
You might also like:
See something that needs correcting? Let us knowUpdated April 08, 2026