RedwoodSDK server actions from version 1.0.0-beta.50 through the release preceding 1.2.3 enforce HTTP methods but omit origin validation, enabling a same‑site CSRF attack. An attacker can craft a malicious web page that, when visited by a victim, causes the browser to send a request to a server action using the victim’s authenticated session cookie. This can lead to unauthorized manipulation of application data or state, compromising the integrity of the affected system. The weakness is identified as CWE‑352.

All users of Redwood SDK versions 1.0.0‑beta.50 to 1.2.2 inclusive are affected. The patch is supplied in version 1.2.3, which introduces proper origin checks for server actions.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. The likely attack vector is same‑site CSRF, requiring that the attacker host a page which the victim’s browser loads and that the victim be authenticated to the target site. While the exploit does not require elevated privileges beyond a normal user session, the ability to trigger privileged actions can have significant impact. Given the absence of advanced prerequisites and the lack of a known public exploit, the overall risk is moderate, but active mitigation is recommended.