AIKIDO-2026-270381

Duende.BFF.Yarp is vulnerable to Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF)GHSA-4j63-5v5f-xcc4 Published Today

Medium Risk

This Affects:

Duende.BFF.Yarp

4.0.0 - 4.0.3

Fixed in 4.0.4

4.1.0 - 4.1.2

Fixed in 4.1.3

4.2.0 - 4.2.0

Fixed in 4.2.1

4.3.0 - 4.3.0

Fixed in 4.3.1

Are you affected? Scan for Free

TL;DR

Duende.BFF blocks cross-site request forgery on its API endpoints by requiring a custom X-CSRF: 1 header, but routes that a dynamic frontend configures with WithRemoteApis set their endpoint at request time, after the anti-forgery middleware already ran with no endpoint to check. A cross-site page can make a signed in user's browser send a request to a WithRemoteApis route without that header, and the BFF still proxies it to the backend with the user's access token attached, so the backend performs the state changing operation even though the attacker cannot read the response. The fix checks the anti-forgery header in the remote route handler before it attaches the access token and forwards the request.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you configure a dynamic frontend with WithRemoteApis to proxy a remote API.