PT-2026-97678

CVE-2026-96388

Published

2026-09-23

Updated

2026-10-22

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Tawk.to - Live chat application versions 0.0.0 through 3.0.4

Description Cross-Site Request Forgery (CSRF) occurs when the module does not sufficiently validate certain requests. This allows an attacker to trick an authenticated user into performing unintended actions. CSRF is a flaw where a malicious website causes a user's web browser to perform an unwanted action on a different website where the user is currently authenticated.

Recommendations Update Drupal Tawk.to - Live chat application to a version later than 3.0.4.

Exploitability

Exploit

Fix

Impacts

Researchers