Tawk.to Live Chat CVE-2026-96388

Exploitation requires a victim who is authenticated to the Drupal site with sufficient privileges over the Tawk.to Live Chat module (typically an administrator) and who has an active session when tricked into interacting with attacker-controlled content (UI:R) - for example loading a malicious page. The attacker needs no account or privileges of their own (PR:N), and no special non-default configuration is indicated in the sources beyond having the module installed at a version from 0.0.0 up to but not including 3.0.4. The requirement for an authenticated, privileged victim and active user interaction is the primary factor limiting real-world exploitation; the exact request/endpoint trigger is not described in the available sources.

This is a moderate-severity Cross-Site Request Forgery issue (CVSS 5.4) in the Tawk.to Live Chat contributed module for Drupal, and the signals point to low real-world urgency despite the network attack vector. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) shows the attacker needs no privileges of their own but does require victim user interaction (UI:R), with only low confidentiality and integrity impact and no availability impact - characteristic of a classic CSRF where the attacker borrows an authenticated victim's session. EPSS is 0.10% (1st percentile), indicating a very low modeled probability of exploitation. There is no CISA KEV listing and no public exploit or PoC reference in the supplied data, so the exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' consistent with a patch-when-convenient item rather than an emergency. The PR:N in the vector means the attacker is unauthenticated, but note that successful exploitation still depends on an authenticated victim (typically a Drupal administrator) with an active session performing the triggering interaction - a limiting factor the raw score does not fully convey. Overall this is a genuine but low-priority issue: patch within the normal maintenance window.

An attacker crafts a malicious web page or email containing a forged request targeting the Tawk.to module's configuration endpoints and lures a logged-in Drupal administrator into visiting it. Because the victim's browser automatically sends their valid session cookies, the forged request executes with the victim's privileges, allowing unauthorized changes to the chat module's settings. No public exploit code is identified in the available data, and the specific trigger mechanics are not described in the sources.