Echo, a Go web framework, contains a flaw in its MethodOverride middleware that can bypass CSRF protection. The vulnerability allows an attacker to rewrite a legitimate POST request into a safe HTTP method before the CSRF middleware evaluates it, causing both token verification and Sec‑Fetch‑Site checks to be skipped. Because the override changes are applied prior to CSRF validation, an attacker can execute state‑changing actions on behalf of an authenticated user without requiring a valid CSRF token.

The issue affects Echo versions prior to 4.16.0 and 5.4.0. Users running any earlier release of Echo’s core library are potentially exposed. The specific products are the labstack:echo framework for Go, with the affected series being v4.15.x and older, and v5.3.x and earlier.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited. Exploitation requires an authenticated victim and a cross‑site request that can control the override value; however, the default header getter for X-HTTP-Method-Override is not settable by a cross‑site form, which limits the ease of attack. The attacker must therefore locate a scenario where the override value can be influenced by the victim’s browser, which is a non‑trivial prerequisite. Overall, the risk is moderate, but organizations should consider patching promptly to eliminate the possibility of an attacker leveraging this bypass.