Auth and sessions
State-changing request accepted from another origin
A form or endpoint changes data on a cookie-authenticated request without checking where the request came from.
TermsAPI (the interface other software calls; tested directly, without the UI in between) · cross-site request forgery (another site making a user's browser send a state-changing request with the user's cookies) · cross-site scripting (user-typed text rendered as markup, so a script in a name or comment runs in other users' browsers) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
None of the 15 generated applications included CSRF protection. Framework defaults cover some cases; custom endpoints do not inherit them.
Five coding agents built 15 identical applications from the same prompts; the applications contained 69 vulnerabilities in total, every agent produced at least one server-side request forgery, none of the 15 applications had CSRF protection or security headers, and every login page shipped without rate limiting or account lockout.
Source: Tenzai, 2026-01 · verified 2026-09-21
How we detect it
Submit each mutation from a page on a different origin with cookies present.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
State-changing requests are protected against cross-site request forgery
automated Submit a state-changing request from a page on another origin with the victim's cookies present.
The request is rejected (origin check, SameSite cookie or token) for every tested mutation.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.