A vulnerability in lcg0124 BootDo allows an attacker to forge authenticated requests on behalf of a logged-in user, potentially causing unauthorized state changes or data exposure, as it matches the Cross‑Site Request Forgery weakness identified by CWE-352. The issue stems from insufficient request validation, and the affected component is unspecified but exists within the application’s request handling logic. The exploit can be performed remotely and is publicly available, enabling attackers to target users without direct access to the system.

The affected product is lcg0124 BootDo. All releases up to the code revision e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb are affected. Due to the rolling release model, exact version ranges cannot be listed, so any deployment running a commit prior to the identified fix is vulnerable.

The CVSS score of 5.3 indicates a moderate severity. EPSS shows an exploitation probability of less than 1%, and the vulnerability is not in the CISA KEV catalog. Attackers can leverage the CSRF flaw by getting a victim’s browser to submit a crafted HTTP request, often through a malicious link or embedded content. While the vulnerability does not require authentication to the application itself, it relies on the victim’s authenticated session, making the threat primarily to users with active sessions. The lack of a widespread KEV listing and low EPSS score suggest the risk is moderate, but the vulnerability remains exploitable with readily available payloads.