RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions

Description

Server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim’s session cookie attached.

Recommendation

Update the rwsdk package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.0-beta.50, <= 1.2.2
• Patched version(s): 1.2.3

References

• GHSA-m2m6-cff5-3w7c
• CVE-2026-42190
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
• @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - CVE-2026-49993
• @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - @nuxt/webpack-builder - CVE-2026-49993
• Feathers has an origin validation bypass via prefix matching - CVE-2026-27192

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

rwsdk