CVE-2026-29084
MEDIUM4.6EPSS 0.01%Gokapi has CSRF in Login Endpoint
Published: 3/5/2026Modified: 3/23/2026
Description
### Summary The login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a session on successful credential validation. *Issue found by [aisafe.io](aisafe.io)* ### Impact An attacker can force a victim browser into a session associated with an existing user account where the attacker knows the credentials, causing user confusion, activity misattribution, and potential misuse of trusted user actions.
Affected packages (2)
- Go/github.com/forceu/gokapifrom 0, < 2.2.3
- Go/github.com/forceu/gokapifrom 0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |