Form action hijacking (reflected)
Summary: PortSwigger describes form action hijacking as occurring when an application places user-supplied input into the action URL of an HTML form, letting an attacker construct a URL that redirects the form to their own server when another user visits it. If the user submits the form, its contents including the victim's input go directly to the attacker, and even without sensitive data the form may deliver a valid CSRF token that enables CSRF attacks.
What you should know: A single crafted link can turn your own login or contact form into a delivery mechanism for a valid CSRF token, and browsers autocompleting previously entered input can make the leak worse without the user typing anything.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026