OOOsec
#0x5A

flawed CSRF implementation

@cybeidasubmitted a report toJupiterMay 16, 2026 at 21:47
Severity
INFORMATIONAL
CVSS
5.9CVSS:3.1/AV:N/PR:N/AC:H/UI:R/I:H/A:N/C:L/S:U
Vulnerability TypeCross-Site Request Forgery (CSRF)
Asset*.jup.ag - Jupiter Domain
Endpointhttps://discuss.jup.ag/

Description

The CSRF token is not invalidated after LOGOUT and after Password reset, this can introduce an attack surface where an attacker with old CSRF token can craft a request using the old CSRF and sending it to the victim. This can lead to a wide range of impact from Account takeover to victim information change

Steps to Reproduce

Impact

An attacker can be able to get victim account

Activity

@thibaultclosed the report asInformative
May 17
@thibaultchanged the severity frommediumtolow
May 17
@cybeidacommented.
May 17
@cybeidacommented.
May 17
@cybeidacommented.
May 17
@thibaultchanged the severity fromlowtoinformational
May 17
@cybeidacommented.
May 17
@cybeidacommented.
May 17
@raccoonsdisclosed this reportPublic Disclosure
May 22