Find a vulnerability

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c3.0.4"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/tawk_to"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c3.0.4"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96388"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/s4m0y3d"
      ],
      "name": "Tin Nguyen Huu (s4m0y3d)"
    }
  ],
  "details": "This module provides integration of the tawk.to live chat for Drupal sites.\n\nThe module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.",
  "id": "DRUPAL-CONTRIB-2026-184",
  "modified": "2026-09-23T17:14:48.000Z",
  "published": "2026-09-23T17:14:48.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-184"
    }
  ],
  "schema_version": "1.7.0"
}