The hackage-server application is vulnerable to Cross-Site Request Forgery (CSRF), which could allow remote attackers to perform unauthorized administrative actions or modify user accounts.

This is a Cross-Site Request Forgery (CWE-352) vulnerability. The application fails to validate requests, allowing an attacker to trigger actions on behalf of an authenticated user or, in some cases, perform unauthenticated actions like account creation.

The lack of CSRF protection poses a significant risk to the integrity and availability of the package repository. A successful exploit could lead to unauthorized code execution through malicious package uploads or the compromise of administrative functions, resulting in severe reputational damage and supply chain risk. With a CVSS score of 9.6, this vulnerability is critical due to the potential for total impact on system confidentiality and integrity.

Immediate Action: Review the official OSV advisory (HSEC-2026-0002) for specific security guidance or configuration changes, as a direct patch version may not be explicitly listed.

Proactive Monitoring: Monitor server logs for suspicious POST requests originating from unexpected referrers or unusual patterns of administrative activity.

Compensating Controls: Implement strict SameSite cookie attributes and consider deploying a Web Application Firewall (WAF) to inspect and block suspicious cross-origin requests.

Public Exploit Available: No

Given the critical CVSS severity, administrators should prioritize implementing site-wide CSRF protections immediately. If a software update is not yet available, verify that your deployment configuration follows the latest security hardening guidelines provided by the vendor to minimize the attack surface.