CVE-2026-45430
CSRF Vulnerability in Backdrop CMS Salesforce Module
Publication date: 2026-05-12
Last updated on: 2026-05-12
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| backdrop | saleforce_module | to 1.x-1.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Salesforce module for Backdrop CMS before version 1.x-1.0.1 has a critical vulnerability related to Cross-Site Request Forgery (CSRF). Specifically, it does not properly generate or validate a cryptographically random state parameter, which is necessary to protect the authorization flow from CSRF attacks.
Because the OAuth callback endpoint is accessible to most authenticated users and potentially anonymous users depending on site configuration, this flaw increases the risk that unauthorized actions could be performed by attackers exploiting the CSRF vulnerability.
How can this vulnerability impact me? :
This vulnerability can allow attackers to perform unauthorized actions on behalf of legitimate users by exploiting the CSRF flaw in the authorization flow.
Since the OAuth callback endpoint is widely accessible, attackers might trick users into executing unwanted operations, potentially leading to compromised user accounts, unauthorized data access, or manipulation within the Salesforce integration on Backdrop CMS.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability relates to the Salesforce module for Backdrop CMS prior to version 1.x-1.0.1, which does not properly use a random state parameter to protect against CSRF attacks in the authorization flow.
Detection involves verifying the version of the Salesforce module installed on your Backdrop CMS instance.
- Check the installed version of the Salesforce module in your Backdrop CMS admin interface or by inspecting the module files.
- Look for the OAuth callback endpoint accessibility and whether it is exposed to authenticated or anonymous users.
There are no specific network or system commands provided in the available resources to detect this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the Salesforce module for Backdrop CMS to version 1.x-1.0.1 or later, where the vulnerability has been fixed.
Since the vulnerability involves improper CSRF protection in the authorization flow, ensuring that the OAuth callback endpoint is not unnecessarily exposed to anonymous or unauthorized users can reduce risk.
Review and tighten access controls on the OAuth callback endpoint as a temporary measure until the module is updated.