CVE-2023-34927: Casdoor Cross-Site Request Forgery vulnerability

The vulnerability exists in the /api/set-password endpoint which is handled by the SetPassword function. The GitHub issue (#1531) demonstrates that password changes can be executed via forged POST requests without CSRF tokens or current password verification. In Go web applications, handler functions typically correspond directly to API endpoints. The combination of 1) no CSRF token requirement, 2) no current password check, and 3) state-changing POST operation matches the described vulnerability characteristics. While exact file paths aren't explicitly documented, Casdoor's architecture follows standard Go project structure where account-related handlers reside in controllers/account.go.