CVE-2026-42190

{
  "id": "CVE-2026-42190",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T20:16:31.580",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3."
    },
    {
      "lang": "es",
      "value": "RedwoodSDK es un framework React con prioridad en el servidor. Desde la versión 1.0.0-beta.50 hasta antes de la versión 1.2.3, las acciones del servidor en rwsdk aplican la aplicación forzosa del método HTTP pero no la validación de origen. Una solicitud originada desde un origen diferente que el navegador trata como del mismo sitio puede invocar una acción del servidor con la cookie de sesión de la víctima adjunta. Este problema ha sido parcheado en la versión 1.2.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "redwoodjs",
          "product": "sdk",
          "versions": [
            {
              "version": ">= 1.0.0-beta.50, < 1.2.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T12:47:18.442327Z",
          "id": "CVE-2026-42190",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.0.1",
              "versionEndExcluding": "1.2.3",
              "matchCriteriaId": "3AF1C0CD-80D0-4A93-A6F8-F0E844C54FCB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta50:*:*:*:*:*:*",
              "matchCriteriaId": "10DFDEC7-D2A7-4AC5-AA0E-E71B483AB0E1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta51:*:*:*:*:*:*",
              "matchCriteriaId": "DD867EAC-3C9A-4292-AC02-2FEF85F180E2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta52:*:*:*:*:*:*",
              "matchCriteriaId": "10E3130A-AD36-4681-B938-CC3A4B996D27"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta53:*:*:*:*:*:*",
              "matchCriteriaId": "C19C1D4F-E694-4715-B545-426D87630607"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta53_test20260205213024:*:*:*:*:*:*",
              "matchCriteriaId": "02ADC1FE-B254-49AC-AAE6-3A2FE05CD8FA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta54:*:*:*:*:*:*",
              "matchCriteriaId": "46F4EA7D-00A2-46BA-9B28-1ED6F6CA810F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta55:*:*:*:*:*:*",
              "matchCriteriaId": "CCA20DB6-1D44-468F-8E39-36F3EE4EEA9C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta56:*:*:*:*:*:*",
              "matchCriteriaId": "50C28F45-A680-490A-B5D0-DE9D38F0625F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta57:*:*:*:*:*:*",
              "matchCriteriaId": "82672146-941B-42C0-B135-E3300A2418F5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta58:*:*:*:*:*:*",
              "matchCriteriaId": "C1817FEE-0168-4C55-B641-A0CE943CC089"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/redwoodjs/sdk/releases/tag/v1.2.3",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}