CVE-2026-4091

Name of the Vulnerable Software and Affected Versions OPEN-BRAIN versions prior to 0.5.1

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions on a web application. This occurs because the func page main() function fails to implement nonce verification on the settings form. A nonce is a unique token used to ensure that a request was intentionally sent by the user. Consequently, unauthenticated attackers can inject malicious web scripts through a forged request if they can persuade a site administrator to click a link.

Recommendations Update the plugin to a version newer than 0.5.0. As a temporary mitigation, restrict access to the settings form handled by the func page main() function.