GraphQL content type not validated
Summary: PortSwigger Research describes cross-site request forgery vulnerabilities in GraphQL endpoints that arise when the content type is not validated. POST requests with a content-type of application/json are secure against forgery as long as that content type is validated, but GET requests or requests with a content-type of x-www-form-urlencoded can be sent by a browser, and attackers may then craft exploits using a valid CSRF token from a previous request.
Bottom line: A GraphQL endpoint that accepts form-encoded or GET requests can be driven by a victim's own browser, and a CSRF token lifted from an earlier request is enough to make the forged call look legitimate.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026