Browse / Bypasses / CSRF protections

Getting past CSRF protections

Tokens, SameSite cookies, and Origin or Referer checks. 56 disclosed reports got past one.

1. Bypassing Digits origin validation which leads to account takeoverImproper Authentication - Generic · X / xAI
   619 votes
2. XSS in www.shopify.com/markets?utm_source=Cross-site Scripting (XSS) - Reflected · low · Shopify
   159 votes
3. CSRF protection bypass in GitHub Enterprise management consoleCross-Site Request Forgery (CSRF) · high · GitHub
   $10,000152 votes
4. DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolServer-Side Request Forgery (SSRF) · PortSwigger Web Security
   144 votes
5. Bypassing Digits bridge origin validationImproper Authentication - Generic · X / xAI
   92 votes
6. CSRF on /api/graphql allows executing mutations through GET requestsCross-Site Request Forgery (CSRF) · high · GitLab
   $3,37088 votes
7. Login CSRF vulnerability on hackerone.comCross-Site Request Forgery (CSRF) · low · HackerOne
   $50084 votes
8. TikTok's pixel/sdk.js leaks current URL from websites using postMessageImproper Authorization · medium · TikTok
   79 votes
9. CSRF protection bypass on TikTok Webcast EndpointsCross-Site Request Forgery (CSRF) · medium · TikTok
   $2,50079 votes
10. Self XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/new Cross-site Scripting (XSS) - Generic · medium · GitHub
    76 votes
11. SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.Improper Certificate Validation · high · Brave Software
    73 votes
12. CSRF protection bypass on any Django powered site via Google AnalyticsCross-Site Request Forgery (CSRF) · Django
    70 votes
13. Revocation API Token by Bypassing The XSRF TokenCross-Site Request Forgery (CSRF) · critical · Enjin
    60 votes
14. Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)Cross-site Scripting (XSS) - Stored · critical · Essity
    48 votes
15. Shopify.com Web Cache Deception vulnerability leads to personal information and CSRF tokens leakageViolation of Secure Design Principles · low · Shopify
    $80048 votes
16. Authentication token and CSRF token bypassImproper Access Control - Generic · high · Enjin
    $30044 votes
17. Sub-Domain Takeover at http://www.codefi.consensys.net/Improper Access Control - Generic · medium · MetaMask
    $50042 votes
18. CSRF on cards APICross-Site Request Forgery (CSRF) · X / xAI
    41 votes
19. Make API calls on behalf of another user (CSRF protection bypass)Cross-Site Request Forgery (CSRF) · Vimeo
    33 votes
20. CSRF to XSSCross-Site Request Forgery (CSRF) · medium · U.S. Dept Of Defense
    31 votes
21. http request smuggling in pscp.tv and periscope.tvHTTP Request Smuggling · high · X / xAI
    $56024 votes
22. RXSS - http://macademy.mtnonline.comCross-site Scripting (XSS) - Reflected · medium · MTN Group
    23 votes
23. H1514 Stored XSS in Return Magic App portal contentCross-site Scripting (XSS) - Stored · medium · Shopify
    21 votes
24. Open Redirect (6.0.0 < rails < 6.0.3.2)Open Redirect · high · Ruby on Rails
    $1,00019 votes
25. Digest Auth State Leak on Cross-Origin Redirect via Netrc - Username and Password Hash Sent to Wrong HostInsufficiently Protected Credentials · medium · curl
    17 votes
26. RXSS - https://████████/Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    17 votes
27. [account-global.ubnt.com] CRLF InjectionCRLF Injection · low · Ubiquiti Inc.
    17 votes
28. Open redirect on https://blog.fuzzing-project.orgOpen Redirect · medium · Hanno's projects
    16 votes
29. Bypass to postMessage origin validation via FTPCross-site Scripting (XSS) - Generic · high · Slack
    15 votes
30. Gitlab Pages token theft using service workersImproper Authorization · medium · GitLab
    $1,68014 votes
31. Bypassing CSRF Token On Reply Message & Send MessageCross-Site Request Forgery (CSRF) · low · Reverb.com
    14 votes
32. CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protectionCross-Site Request Forgery (CSRF) · critical · Ubiquiti Inc.
    14 votes
33. Bypassing SOP with XSS on account.my.games leading to steal CSRF token and user informationCross-Site Request Forgery (CSRF) · Mail.ru
    13 votes
34. Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300Command Injection - Generic · high · Ubiquiti Inc.
    12 votes
35. Account takeover vulnerability by editor role privileged users/attackers via clickjackingUI Redressing (Clickjacking) · high · WordPress
    8 votes
36. UniFi v3.2.10 Cross-Site Request Forgeries / Referer-Check BypassCross-Site Request Forgery (CSRF) · Ubiquiti Inc.
    8 votes
37. Login CSRF can be bypassed (Similar approach to previous one).Cross-Site Request Forgery (CSRF) · IRCCloud
    8 votes
38. RXSS - ████Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    7 votes
39. The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routesCross-Site Request Forgery (CSRF) · medium · Ruby on Rails
    7 votes
40. CSRF in cancel group and private show requestsCross-Site Request Forgery (CSRF) · medium · Chaturbate
    $3007 votes
41. CSRF Token Bypass in Account DeletionCross-Site Request Forgery (CSRF) · low · GitLab
    7 votes
42. [api.owncloud.org] CRLF InjectionCRLF Injection · ownCloud
    7 votes
43. Security Issue : CSRF Token Design FlawCross-Site Request Forgery (CSRF) · drchrono
    7 votes
44. Leaking CSRF token over HTTP resulting in CSRF protection bypassCross-Site Request Forgery (CSRF) · Coinbase
    $1,0007 votes
45. HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0Cross-site Scripting (XSS) - Stored · low · Nextcloud
    6 votes
46. Bypassed password authentication before enabling OTP verificationImproper Authentication - Generic · Shopify
    $5006 votes
47. [gratipay.com] CRLF InjectionCRLF Injection · high · Gratipay
    $406 votes
48. [mobile.twitter.com / twitter.com] CSRF protection bypassCross-Site Request Forgery (CSRF) · X / xAI
    6 votes
49. RXSS - https://███/Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    5 votes
50. ClickJacking on IMPORTANT Functions of YelpUI Redressing (Clickjacking) · low · Yelp
    5 votes
51. [doc.owncloud.org] CRLF InjectionCRLF Injection · ownCloud
    5 votes
52. CRLF Injection on ███████CRLF Injection · medium · U.S. Dept Of Defense
    4 votes
53. Csrf on creating courseCross-Site Request Forgery (CSRF) · Udemy
    3 votes
54. apps.owncloud.com: Referer protection BypassedImproper Authentication - Generic · ownCloud
    3 votes
55. rails-ujs will send CSRF tokens to other originsCross-Site Request Forgery (CSRF) · Ruby on Rails
    3 votes
56. RXSS Via URI Path - https://██████████/Cross-site Scripting (XSS) - Reflected · medium · U.S. Dept Of Defense
    2 votes