CVE-2026-89279

Deferred Deferred - Pending Action

Cross-Site Request Forgery in AuthTake Allows Encryption Brute Forcing

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description

Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake: from v1.3 before v1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-89279

EUVD

EUVD-2026-98473

Affected Vendors & Products

Vendor	Product	Version / Range
AuthTake	Technology	Inc. authtake v1.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in AuthTake Technology Inc.'s Authtake software. It allows attackers to trick users into making unintended requests that can lead to encryption brute forcing. The flaw exists in versions before v1.4.

Detection Guidance

This vulnerability is a CSRF issue in AuthTake Technology Inc. Authtake versions before v1.4. Detection requires checking for improper CSRF token validation in web requests. Inspect network traffic for POST requests without CSRF tokens or with predictable tokens. Review server logs for unauthorized state changes triggered by authenticated users without proper validation.

Impact Analysis

An attacker could exploit this to force a user's browser to send malicious requests, potentially bypassing authentication or enabling brute force attacks on encryption. This could lead to unauthorized access or data compromise if the user has elevated privileges.

Compliance Impact

This CSRF vulnerability could potentially allow unauthorized actions to be performed on behalf of authenticated users, which may lead to data breaches or unauthorized access. This could impact compliance with GDPR by violating data protection principles and HIPAA by compromising protected health information if exploited.

Mitigation Strategies

Update AuthTake to version 1.4 or later to address the CSRF vulnerability. Implement CSRF tokens in authentication requests and review network traffic for suspicious cross-site requests.

Hi! I’m here to help you understand CVE-2026-89279. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70