The vulnerability, classified under CWE-204 (Cacheable Information) and CWE-352 (Cross‑Site Request Forgery), allows an attacker to recover the stable session CSRF token that a Mojolicious application returns on each request and that is cached per session. The token is embedded in a hidden input field that is echoed in the response body. When the response is gzip‑compressed and also contains attacker‑controlled input, the deterministic token values and the resulting compressed lengths form a BREACH oracle. By observing the compressed size, an attacker can deduce the token value and subsequently pass csrf_protect validation, effectively bypassing the application’s CSRF defenses.

Mojolicious versions from 4.59 up to, but not including, 9.48 for Perl are affected.

The CVSS score of 9.1 indicates a high severity vulnerability, while the EPSS score of less than 1% shows a very low exploitation probability at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely need remote access to send requests and observe compressed responses, implying that a remote BREACH oracle could be leveraged to extract the CSRF token.