AIKIDO-2026-612257

aimeos/ai-client-html is vulnerable to Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) Pre-CVE Published 2 days ago

Medium Risk

This Affects:

aimeos/ai-client-html

2016.07.1 - 2022.10.16

Fixed in 2022.10.17

2023.04.1 - 2023.10.22

Fixed in 2023.10.23

2024.04.1 - 2024.10.10

Fixed in 2024.10.11

2025.04.1 - 2025.10.7

Fixed in 2025.10.8

2026.04.1 - 2026.04.4

Fixed in 2026.04.5

Are you affected? Scan for Free

TL;DR

Checkout handlers that set the billing address, delivery address, delivery service, and payment service accept state changing requests over any HTTP method, reading the selected option from parameters such as ca_billingoption and c_paymentoption. A cross-site request from another page can load these endpoints with attacker chosen parameter values and silently change a shopper's checkout selections during an active session. The fix rejects these requests unless they arrive as POST.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

aimeos/ai-client-html is vulnerable to Cross-Site Request Forgery (CSRF) in versions 2016.07.1 - 2022.10.16, 2023.04.1 - 2023.10.22, 2024.04.1 - 2024.10.10, 2025.04.1 - 2025.10.7 and 2026.04.1 - 2026.04.4.