CVE-2026-33920

LowCVSS 3.5/10Last modified Oct 15, 2026

Description

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-339215.2The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to ev CVE-2026-339226.0A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validatio CVE-2026-339237.2A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update CVE-2026-339247.2Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the upda CVE-2026-339294.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects CVE-2026-33937.8A security vulnerability has been detected in jarikomppa soloud up to 20200207. The impacted element is the function SoLoud::Wav::loadflac o CVE-2026-339305.9Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long CVE-2026-339316.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecu CVE-2026-339325.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored CVE-2026-339336.1OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and pri CVE-2026-339344.3OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a mi CVE-2026-339357.5MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out a