Lab: Same Site Lax bypass via method override

Summary: PortSwigger's lab demonstrates a CSRF attack against an email-change function that lacks unpredictable tokens, where the site sets session cookies without explicit SameSite attributes so browsers apply the default Lax restriction. Because Lax still sends the session cookie on cross-site top-level navigation GET requests, the lab shows a POST endpoint can be reached via GET with a _method parameter override, which the server accepts and which changes the account email.
Bottom line: The default SameSite Lax setting many teams treat as a baseline defense still lets a session cookie ride along on a top-level navigation, so an endpoint that accepts a method override like _method can be driven by a crafted link without any token to stop it.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026