Description

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. This issue has been patched in version 1.0.0-beta.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T19:17:28.100Z",
  "pubdate": "2026-09-03T19:17:28.100Z",
  "executiveSummary": "Waku versions prior to 1.0.0-beta.1 are susceptible to Cross-Site Request Forgery (CSRF) due to improper validation of request origins within the RSC (React Server Components) request dispatcher.\nThe vulnerability allows a remote, unauthenticated attacker to induce a victim's browser into executing authenticated, state-mutating server actions exposed via 'use server' directives.\nBy leveraging CORS-safelisted content types (text/plain), the attack bypasses browser-level preflight checks, allowing malicious POST requests to be sent directly to the server.\nSince the requests carry the victim's session cookies, the server treats the forged request as a legitimate user action, potentially leading to unauthorized data modification, account takeover, or administrative actions.\nThis vulnerability poses a significant risk to application integrity and data privacy, requiring immediate updates to the framework to ensure strict Origin or Sec-Fetch-Site header validation.",
  "technicalDetails": "The root cause of this vulnerability lies in the Waku RSC request dispatcher's failure to perform adequate origin-based security checks for server action endpoints. In modern web architectures, CSRF protections typically rely on the verification of the Origin or Sec-Fetch-Site headers to ensure that requests originate from a trusted domain.\nWaku's implementation allowed server actions—defined by the 'use server' directive—to be triggered without this validation. An attacker can exploit this by hosting a malicious website that contains a hidden form or a fetch request targeting the victim's Waku-based application.\nBecause the server accepts a 'text/plain' content type for these RSC requests, the browser is not mandated to initiate a CORS preflight (OPTIONS) request. This allows the attacker to circumvent CORS restrictions that would otherwise prevent a cross-origin entity from interacting with the server. Consequently, the browser automatically attaches ambient credentials, such as session cookies, to the POST request.\nThe attack flow follows a predictable pattern: 1) The attacker lures a logged-in user to a malicious site controlled by the attacker. 2) The malicious site scripts an asynchronous POST request to the target Waku application's server action endpoint. 3) The request, sent with 'text/plain' encoding, bypasses preflight scrutiny. 4) The Waku server receives the request, identifies the endpoint as a valid server action, and executes the business logic using the victim's authenticated session context.\nAffected versions include all iterations prior to 1.0.0-beta.1. The vulnerability is highly impactful as it enables unauthorized state changes, such as modifying user profiles, deleting data, or triggering transactional processes, all without the user's consent or knowledge. The exposure is effectively network-based, as the attacker relies on the victim's browser to act as a proxy for the forged request."
}