CVE-2026-42190

MediumCVSS 5.3

Published: 08/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

In RedwoodSDK versions 1.0.0-beta.50 to before 1.2.3, server actions enforce HTTP method but not origin validation. A request from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached.

Risk Assessment

An attacker can invoke server actions in the context of a logged-in user, potentially leading to unauthorized operations and breach of data confidentiality or integrity.

Recommendation

Update RedwoodSDK to version 1.2.3 or later, which includes the origin validation fix.

Other vulnerabilities in RedwoodSDK

CVE-2026-39371High
RedwoodSDK from 1.0.0-beta.50 to 1.0.5 allows server functions from 'use server' files to be invoked via GET requests, bypassing intended HTTP method. In cookie-authenticated apps with SameSite=Lax, CSRF attacks can trigger state changes.

Original NVD description (English source)

RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS