{"id":"EUVD-2026-28823","revision":"7336450f304c4e729ee02d800a09caaf","records":[{"revision":"7336450f304c4e729ee02d800a09caaf","observedAt":"2026-11-01T07:12:02.056+00:00","statement":{"source":"euvd","id":"EUVD-2026-28823","aliases":["CVE-2026-42190"],"title":"RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser…","description":"RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","score":5.3,"severity":null}],"references":["https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c","https://github.com/redwoodjs/sdk/releases/tag/v1.2.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28823","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 8, 2026, 7:35:17 PM","dateUpdated":"May 12, 2026, 6:32:06 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28823","identifiers":["EUVD-2026-28823","CVE-2026-42190"]},"retained":false,"historicalAffected":[]}],"coverage":[]}