🔄 06 — Cross-Site Request Forgery
0/3 solved
🔑 Hard — Token Not Session-Bound
CSRF token exists but isn't bound to the user session. Log in as a different user, get their token, and use it to forge requests as another user.
Your CSRF token:
7c1b3f6d9913c6cd6ada9080b9a1a7b1Log in as one user to get a valid token. Then use that same token in a CSRF attack targeting a different user — the token passes because it's validated against the DB, not against the session.