A cross-site request forgery (CSRF) flaw in Blazor and SignalR allows an unauthorized attacker to elevate privileges over a network. By sending a cross-site request to the '/ blazor/refresh' endpoint, an attacker can bind a user's identity to an attacker's circuit, enabling them to act as a signed-in user.