CVE-2026-27632: CSRF in Talishar Flesh and Blood Project

The impact of this CSRF vulnerability is significant, as it allows an attacker to potentially manipulate game state without the user's knowledge or consent. An attacker could, for example, force a player to concede a game, change their deck composition, or perform other actions that would alter the game's outcome. Successful exploitation requires the attacker to know the target's gameName and playerID, but once obtained, the attack can be executed without further authentication. This vulnerability highlights the importance of proper CSRF protection, even in smaller, fan-made projects, as it can lead to significant disruption and unfair advantages within the game.

1. Reserved2026-02-20
2. Published2026-02-25
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-27632 is to upgrade to version 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, which includes the necessary CSRF protections. If upgrading is not immediately feasible, consider implementing a temporary workaround by adding input validation and sanitization to the SubmitChat.php and other game interaction handlers. While not a complete solution, this can reduce the attack surface. Additionally, enforce strict Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, further limiting the potential for CSRF attacks. After upgrading, confirm the fix by attempting to forge a request to a critical endpoint and verifying that it is rejected.