Talishar failed to enforce CSRF protections on key state‑changing endpoints, notably SubmitChat.php. Without a unique, unpredictable session token, an attacker can forge requests that appear to come from an authenticated player, allowing malicious actions to be performed during an active game session.

All versions of Talishar before commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48 are affected. The vulnerability is fixed in that commit, and any downstream builds should be updated to include it.

The CVSS score is 2.6 and the EPSS probability is under 1 %. The CVE is not listed in the CISA KEV catalog. Exploitation requires the victim to be browsing a malicious site while playing a game, and the attacker must know the gameName and playerID. Given the low severity and low exploitation probability, the risk is moderate, but the attack vector is straightforward once the conditions are met.