{"id":"EUVD-2026-28823","enisaUuid":"2c4fe987-77c5-3537-a763-2a8b564855fc","description":"RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim\u0027s session cookie attached. This issue has been patched in version 1.2.3.","datePublished":"May 8, 2026, 7:35:17 PM","dateUpdated":"May 12, 2026, 6:32:06 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c\nhttps://github.com/redwoodjs/sdk/releases/tag/v1.2.3\n","aliases":"CVE-2026-42190\n","assigner":"GitHub_M","epss":0.11,"enisaIdProduct":[{"id":"1044f03f-f3ca-3927-94c2-8eb332a3c590","product":{"name":"SDK","vendor":{"name":"redwoodjs"}},"product_version":"1.0.0-beta.50, \u003c 1.2.3"}],"enisaIdVendor":[{"id":"752e6e01-2167-37de-8fab-5c049e1e3f3d","vendor":{"name":"redwoodjs"}}],"enisaIdVulnerability":[{"id":"04ec6575-3b53-34b7-b9fc-89789a5d4049","vulnerability":{"id":"CVE-2026-42190","description":"RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim\u0027s session cookie attached. This issue has been patched in version 1.2.3.","datePublished":"May 8, 2026, 7:35:17 PM","dateUpdated":"May 12, 2026, 6:32:06 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c\nhttps://github.com/redwoodjs/sdk/releases/tag/v1.2.3\n","enisa_id":"EUVD-2026-28823\n","assigner":"GitHub_M","epss":0.11,"dataProcessed":"Nov 7, 2026, 7:21:17 AM","vulnerabilityProduct":[{"id":"060fd73e-3bcc-33a3-8ef4-c832f16b291b","product":{"name":"SDK","vendor":{"name":"redwoodjs"}},"product_version":"1.0.0-beta.50, \u003c 1.2.3"}],"vulnerabilityVendor":[{"id":"25fa323a-fd97-3def-bc99-fd7bffe798f6","vendor":{"name":"redwoodjs"}}]}}],"enisaIdAdvisory":[]}