medium4.6
CVE-2026-29084
Gokapi has CSRF in Login Endpoint
Impact
### Summary The login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a session on successful credential validation. *Issue found by [aisafe.io](aisafe.io)* ### Impact An attacker can force a victim browser into a session associated with an existing user account where the attacker knows the credentials, causing user confusion, activity misattribution, and potential misuse of trusted user actions.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/forceu/gokapi | < 2.2.3 | 2.2.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Forceu | Gokapi | before 2.2.3 |