Speakr CVE-2026-54510

Exploitation requires ALL of: (1) a victim with an active authenticated Speakr session; (2) the victim to visit attacker-controlled content hosted on a SIBLING SUBDOMAIN of the Speakr instance (UI:R); (3) the deployment's session cookie to be domain-scoped so it is sent cross-subdomain ('the documented cookie conditions'); and (4) the vulnerable Speakr version < 0.8.21-alpha. The attacker needs no valid token or credentials - the is_token_authenticated() check trusts any present token, including request.args.get('token'), without hashing, DB lookup, or validity check. The GET-based CSRF-exemption poison deliberately avoids CORS preflight. The SSO-bypass leg is further gated to accounts whose current_user.password is empty (SSO-only users). Limiting factors: the required sibling-subdomain foothold and domain-scoped cookie configuration are non-trivial and not universal, and victim interaction is mandatory.

Moderate-but-conditional risk. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N = 7.1) frames this as a network, low-complexity, unauthenticated attack requiring only victim interaction, with high integrity impact. That headline understates the real gating: the description explicitly requires attacker-controlled content on a SIBLING SUBDOMAIN of the target 'under the documented cookie conditions' (i.e. domain-scoped session cookies), plus a victim with an active Speakr session who visits the attacker page. That is a meaningful precondition, so I assess AC:H rather than AC:L, lowering my score to roughly 6.3. No EPSS score, KEV entry, or public POC was supplied - per the precision rules this is 'no public exploit identified at time of analysis,' NOT active exploitation. The confidentiality impact is genuinely low (C:L), but integrity is high (I:H) because the chain reaches admin_toggle_admin for privilege escalation and change_password for full SSO-only account takeover, both confirmed by the vendor security advisory and the patch commit. Net: a real, well-documented vulnerability with a clear fix, but the subdomain/cookie/interaction gating and a niche self-hosted product make this a lower operational priority than the 7.1 alone implies. Two independent root causes are confirmed by the commit diff: a process-global CSRF-exemption poison and an unconditional current-password bypass.

An attacker who controls content on a sibling subdomain of a Speakr instance lures a logged-in user to a malicious page; a cross-origin GET to /account?token=anything trips the buggy is_token_authenticated() check, which trusts the unvalidated query token and permanently CSRF-exempts the /account view for the worker's lifetime. The page then auto-submits a cross-origin POST that changes the victim's profile, custom prompts, or administrative status, and - because change_password skips current-password verification on SSO-only accounts - sets a local password to bypass SSO and log in directly. No public POC is referenced, though the vendor advisory and patch commit describe the full chain.