CVE-2026-42190 Details
Description
RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.
A cross-site request forgery (CSRF) vulnerability has been identified in RedwoodSDK versions 1.0.0-beta.50 prior to 1.2.3. The issue arises in server actions, which enforce HTTP methods but lack origin validation. This allows a request from a different origin, treated as same-site by the browser, to invoke a server action with the victim's session cookie. The vulnerability is particularly concerning for applications deployed on custom domains, where an attacker could exploit the flaw by controlling a sibling subdomain or through other means. In local development, the vulnerability can be exploited by sending requests from 'localhost' on a different port to the application's development server.
Users can update to RedwoodSDK version 1.2.3 or later, where the vulnerability has been patched. The patched version enforces an origin match for non-GET action requests, rejecting those that do not match the request's origin unless the origin is listed in the 'allowedOrigins' configuration option.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/redwoodjs/sdk/releases/tag/v1.2.3 | [email protected] | ProductRelease Notes |
| https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| redwoodjs redwoodsdk | >= 1.0.1, < 1.2.3 1.0.0 beta50 1.0.0 beta51 1.0.0 beta52 1.0.0 beta53 1.0.0 beta53_test20260205213024 1.0.0 beta54 1.0.0 beta55 1.0.0 beta56 1.0.0 beta57 1.0.0 beta58 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |