Description
Server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim’s session cookie attached.
Recommendation
Update the rwsdk package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0-beta.50, <= 1.2.2
- Patched version(s): 1.2.3
References
Could your website be exposed too?
SmartScanner can check your website for RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions and gives you actionable findings to investigate.
Start a free scanRelated Issues
- RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
- @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - CVE-2026-49993
- @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - @nuxt/webpack-builder - CVE-2026-49993
- Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2026