Sdk CVE-2026-39371

RedwoodSDK versions 1.0.0-beta.50 to 1.0.5 with cookie-based authentication using SameSite=Lax cookies. Victim must click a crafted link or visit a malicious website to trigger state-changing server functions via GET requests.

Real-world risk is elevated for cookie-authenticated RedwoodSDK applications with state-changing server functions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible attacks with low complexity requiring no privileges but necessitating user interaction (typically social engineering to visit attacker-controlled pages). The high integrity and availability impact (I:H/A:H) reflects potential for unauthorized data modification or service disruption. While no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), the technical barrier is minimal - attackers need only craft malicious links or embed invisible iframes triggering GET navigations. Attack complexity is genuinely low despite UI:R because users routinely click links in emails, messages, or websites. The narrow affected version range (beta.50 through 1.0.5) and recent framework adoption may limit exposure scope, but applications using cookie-based authentication with privileged server functions face concrete CSRF risk. Mitigation urgency is high for affected deployments given the availability of a patch and the framework's server-first architecture where many operations likely qualify as state-changing.

An attacker identifies a RedwoodSDK application running vulnerable versions with a server function that deletes user data or modifies account settings. The attacker crafts a malicious webpage containing a hidden iframe or link pointing to the server function endpoint with a GET request, such as https://vulnerable-app.example/server-functions/deleteAccount. When an authenticated victim visits the attacker's site or clicks the crafted link, their browser automatically attaches session cookies due to SameSite=Lax policy on top-level GET navigation, causing the server function to execute with the victim's privileges and complete the state-changing operation without consent. No public exploit identified at time of analysis, but exploitation requires only basic web development skills to construct cross-site GET requests.