GHSA-p6mr-xf3r-ghq4
Payload has a CSRF Protection Bypass in Authentication Flow
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.
Consumers are affected if ALL of these are true:
- Payload version **< v3.79.1**
- `serverURL` is configured
### Patches
This vulnerability has been patched in **v3.79.1**. Additional validation has been added to the authentication flow.
Consumers should upgrade to **v3.79.1** or later.
### Workarounds
There is no complete workaround without upgrading.
If consumers cannot upgrade immediately, setting `cookies.sameSite` to `'Strict'` will prevent the session cookie from being sent cross-site. However, this will also require users to re-authenticate when navigating to the application from external links (e.g. email, other sites).
References
External links from the advisory. They lead to third-party sites.