https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T11:47:21.703936+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2020-8166 CVE-2020-8166 2026-10-05T11:47:21.722418+00:00

Affected: https://github.com/rails/rails

A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.

 https://cve.radiocsirt.org/vuln/ghsa-jp5v-5gx4-jmj9 GHSA-jp5v-5gx4-jmj9 — Ability to forge per-form CSRF tokens in Rails 2026-10-05T11:47:21.722476+00:00

Affected: RubyGems: actionpack

It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.

Impact ------

Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session.

Workarounds -----------

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.