Lab: CSRF where token validation depends on token being present
Summary: PortSwigger's lab presents an email-change function vulnerable to CSRF because token validation only runs when a token is present, so a request that omits the token passes. Solvers host an HTML page on the exploit server that changes the viewer's email address, logging in with the credentials wiener:peter and using a different address for the final exploit than for their own testing.
Why it matters: The flaw is a validation check that fails open: a missing token is treated as acceptable rather than rejected, so any attacker-hosted page can change a victim's email address without the token ever being supplied.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026