birkir prime <= 0.4.0.beta.0 - Cross-Site Request Forgery in GraphQL | Advisories

Advisories

birkir prime <= 0.4.0.beta.0 - Cross-Site Request Forgery in GraphQL

severity: medium
date: January 29, 2026
Affecting: prime <= 0.4.0.beta.0
CVE: CVE-2025-15550
CWE: CWE-352 Cross-Site Request Forgery (CSRF)
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References: GitHub Issue #547
Credit: NinjaGPT
Description: birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows attackers to exploit GET-based query requests. Attackers can craft malicious GET requests to trigger unauthorized actions against privileged users by manipulating GraphQL query parameters.