A Cross-Site Request Forgery (CSRF) issue exists where the software fails to properly validate the OAuth handshake during interactive authentication. This allows an attacker to hijack the authorization token and bind the site to an attacker-controlled Salesforce account. This issue requires the `salesforce oauth` submodule to be enabled and an active `salesforce oauth` authorization profile to be in use.