Cross-Site Request Forgery Vulnerability in Go Applications by TrustedOrigins

CVE-2025-47909

What is CVE-2025-47909?

The vulnerability in Go applications arises from the improper handling of TrustedOrigins, which permits network attackers to exploit Cross-Site Request Forgery (CSRF) attacks. When a host is included in the TrustedOrigins list, it fails to properly validate the request origins, allowing both HTTP and HTTPS requests. This flaw can be manipulated by attackers who can host forms on malicious domains, leading to unauthorized actions being executed on behalf of users. To mitigate this risk, developers should transition to using net/http.CrossOriginProtection, or utilize backported alternatives available for older versions.

References