CVE-2026-25812
CSRF Vulnerability in PlaciPy 1.0.0 Enables Credentialed CORS Abuse
Publication date: 2026-02-09
Last updated on: 2026-02-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| prasklatechnology | placipy | 1.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in PlaciPy version 1.0.0 arises because the application allows credentialed Cross-Origin Resource Sharing (CORS) requests but does not have any Cross-Site Request Forgery (CSRF) protection mechanisms in place.
This means that while the application accepts requests from other origins with credentials (like cookies or HTTP authentication), it does not verify whether these requests are intentionally made by the authenticated user, leaving it open to CSRF attacks.
How can this vulnerability impact me? :
Because PlaciPy accepts credentialed CORS requests without CSRF protection, an attacker could trick an authenticated user into making unintended requests to the application.
This can lead to unauthorized actions being performed on behalf of the user without their consent, potentially compromising user data or application integrity.
Given the high CVSS score (9.3), the impact is severe, indicating that the vulnerability can be exploited remotely without user interaction and can lead to significant security breaches.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know