-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nodebb | npm | < 2.5.8 | 2.5.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the /register/abort endpoint accepting POST requests without CSRF token validation. Evidence from GitHub issue #11017 shows the route was originally defined without CSRF middleware, and the fix commit 2f9d8c3 adds CSRF token requirements in tests. The registerAbort controller in authentication.js would be the handler for this endpoint, making it the vulnerable function due to missing CSRF protection.