Dashboard / CVE-2026-42190

CVE-2026-42190

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 51/100
Published: 2026-05-08 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Required
S: Unchanged
C: None
I: High
A: None

Description

RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.

Weakness Classification (1)

Affected Software (11)

VendorProductVersion
redwoodjs redwoodsdk 1.0.1 – 1.2.3
redwoodjs redwoodsdk 1.0.0
redwoodjs redwoodsdk 1.0.0
redwoodjs redwoodsdk 1.0.0
redwoodjs redwoodsdk 1.0.0
redwoodjs redwoodsdk 1.0.0
redwoodjs redwoodsdk 1.0.0
redwoodjs redwoodsdk 1.0.0
redwoodjs redwoodsdk 1.0.0
redwoodjs redwoodsdk 1.0.0
redwoodjs redwoodsdk 1.0.0

References & Advisories (2)

Bug Bounty Relevance

51 / 100
✓ Network accessible
✓ No authentication

CVSS Score

5.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS — Exploitation Probability

0.11%
Raw Score 0.001110
Percentile 1.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00111
2026-10-28
0.00111

Intelligence Sources

nvd ref →

External Links