Tawk To Live Chat Application
Monthly
Cross-site request forgery in the Drupal Tawk.to Live Chat module (versions 0.0.0 through 3.0.4) lets an unauthenticated remote attacker induce a logged-in, privileged Drupal user to submit unintended requests, with limited confidentiality and integrity impact. The attacker needs no account of their own, but exploitation requires an active victim session and user interaction (UI:R). EPSS is 0.10%, no public exploit was identified at the time of analysis, and a vendor patch is available via Drupal SA-CONTRIB-2026-184.
Cross-site request forgery in the Drupal Tawk.to Live Chat module (versions 0.0.0 through 3.0.4) lets an unauthenticated remote attacker induce a logged-in, privileged Drupal user to submit unintended requests, with limited confidentiality and integrity impact. The attacker needs no account of their own, but exploitation requires an active victim session and user interaction (UI:R). EPSS is 0.10%, no public exploit was identified at the time of analysis, and a vendor patch is available via Drupal SA-CONTRIB-2026-184.