CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Vulnerabilities
How this weakness shows up in real applications — how it works, impact, and remediation:
Impactr finds and proves whether CWE-352 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.