AIKIDO-2025-10461

TL;DR

Affected versions of this package are vulnerable to Cross-Site Request Forgery due to reusing outdated CSRF tokens cached during initial page load rather than dynamically fetching the latest tokens from the window object for each request. This flaw allows attackers to capture a token before server-side rotation, then forge malicious requests during the grace period where both old and new tokens remain valid. By tricking an authenticated user into executing these requests, attackers could bypass CSRF protections to perform unauthorized actions like account takeover or data manipulation, leveraging the server's acceptance of stale tokens.