Authtake EUVD-2026-98473

Exploitation requires a victim who holds an active, authenticated session to the Authtake application (version 1.3 up to but not including 1.4) and who is then tricked into loading attacker-controlled content - a malicious link, page, or email - that issues the forged request (UI:R). It is limited by the absence of any standard anti-CSRF defense in the vulnerable versions and by the fact that no attacker authentication is needed (the victim's session is abused); the attack fails if the user is not logged in, if CSRF tokens/SameSite protections are enforced, or if the user never interacts with the malicious content. Impact is confined to integrity - no data disclosure or denial of service.

CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating a network-reachable, low-complexity CSRF (CWE-352) whose only impact is to integrity (I:H), with no confidentiality or availability consequence. The PR:N value reflects standard CSRF modeling - the attacker leverages the victim's authenticated session rather than holding credentials themselves - while UI:R correctly captures the hard requirement that a logged-in user be lured into triggering the forged request. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no evidence of active exploitation or automatability; exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: this is a real but moderate-priority issue, not an emergency - the integrity-only impact, mandatory user interaction, and obscure single-vendor footprint argue against mass exploitation. One data tension to verify: the description's phrase 'allows Encryption Brute Forcing' is unusual for a CSRF and does not obviously map to an integrity-only CSRF outcome; the semantics of the integrity impact should be confirmed with the vendor/TR-CERT advisory.

An attacker crafts a malicious web page or email link and lures a user who is currently authenticated to the Authtake application into visiting it. The page silently submits a forged, state-changing request to Authtake using the victim's session, altering data or settings (integrity impact) without the victim's consent. No public exploit code was identified in the provided data, and success depends on the victim being logged in and interacting with the attacker-controlled content.