Lab: CSRF where token is not tied to user session
Summary: PortSwigger's lab presents an email change function that uses CSRF tokens but does not tie them to the user's session, leaving it open to cross-site request forgery. The exercise asks the tester to host an HTML page on the exploit server that changes a viewer's email address, with two provided accounts available to design the attack.
Bottom line: A CSRF token that is not bound to the session provides no protection at all, so any site relying on tokens alone should confirm they are actually tied to the user's session.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026