| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/forceu/gokapi | < 2.2.3all versions | 2.2.3 |
| gokapi | < 2.2.3 | 2.2.3 |
The login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a session on successful credential validation.
Issue found by aisafe.io
An attacker can force a victim browser into a session associated with an existing user account where the attacker knows the credentials, causing user confusion, activity misattribution, and potential misuse of trusted user actions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free