| Package | Affected versions | Patched versions |
|---|---|---|
| csrf-magic | < 1.0.4 | 1.0.4 |
In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free