THREAT OPS › Threat News › [GHSA] GHSA-hxjg-93wc-h8p8 (high) — Komari: Management Interface CSRF
[GHSA] GHSA-hxjg-93wc-h8p8 (high) — Komari: Management Interface CSRF
GHSA-hxjg-93wc-h8p8 Severity: high CVE: None
Komari: Management Interface CSRF
# Vulnerability Overview
The `session_token` cookie is set **without** the `SameSite` or `Secure` attributes (`login.go:68`).
All `/api/admin/` management endpoints rely solely on this cookie for authentication, with **no CSRF token or Origin validation**.
**The server-side vulnerability is confirmed to exist; howe
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- https://komari.example.com}url
- https://evil.comurl
Original source: https://github.com/advisories/GHSA-hxjg-93wc-h8p8