Executive brief
RedwoodSDK is a framework used to build web applications. A security flaw in how it handles server-side actions allows an attacker who controls a related website (such as a different subdomain on the same company domain) to trick a user's browser into performing unauthorized actions on the user's behalf. This could lead to unauthorized data changes or state modifications within the application, though the attacker cannot directly read the application's data.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in RedwoodSDK (rwsdk) server actions due to a lack of origin validation. While the framework enforces HTTP methods, it fails to verify the 'Origin' or 'Referer' headers against the 'Host' header for non-idempotent requests. An attacker controlling a same-site origin (e.g., a sibling subdomain or a different port on localhost) can induce an authenticated user's browser to invoke server actions with the victim's session cookies attached. This exploit is limited to actions with side effects (writes/state changes) as the attacker cannot read the 'opaque' responses due to CORS restrictions. The issue is patched in version 1.2.3, which introduces mandatory Origin/Host matching and an 'allowedOrigins' configuration.
Affected products
- RedwoodJS rwsdk (RedwoodSDK) >= 1.0.0-beta.50, < 1.2.3
Timeline
- 2026-04-20: patched: Version 1.2.3 released
- 2026-04-20: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE-2026-42190 published to NVD