CSRF Vulnerability in Speakr Web Application by Murtaza Nasir

CVE-2026-54510

What is CVE-2026-54510?

The Speakr web application, designed for transcribing audio recordings, has a vulnerability that allows attackers to bypass its CSRF protection. In versions prior to 0.8.21-alpha, a flaw in the csrf_exempt_for_api_tokens() function permits the unauthorized use of view functions, compromising the protection against CSRF attacks. Attackers can exploit this by sending forged tokens, which then disable CSRF safeguards for sensitive actions, like modifying profile data and changing user passwords. This security issue highlights the need for proper token validation and access control mechanisms to safeguard user data and account integrity.

References