CVE-2026-33920

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.

CVSS 4.0

5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

3.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS

0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-25)

CWE

CWE-352

Published

2026-09-08

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

References

• https://security.nozominetworks.com/NN-2026:18-01
• https://cert-portal.siemens.com/productcert/html/ssa-911336.html

Check your stackJSON