The Backdrop CMS Salesforce integration module, in versions prior to 1.0.1, fails to generate and enforce a random state parameter during the OAuth authorization flow. This omission enables an attacker to craft requests that are accepted as legitimate by the module, thereby performing actions on behalf of the user without their knowledge. The weakness falls under CWE‑352 and can compromise the confidentiality and integrity of data transferred to or from Salesforce.

Backdrop CMS users who have installed the backdrop-contrib/salesforce contributed project with a version less than 1.0.1 are affected. Any site using the module before the 1.0.1 release is vulnerable.

The CVSS score of 7.1 indicates moderate to high severity. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the current exploitation likelihood is uncertain but the lack of a state parameter is a well‑known CSRF risk that can be leveraged remotely via the web interface. An attacker would need to induce the victim to visit a crafted OAuth URL; once the state is not validated, the module would accept the request as valid and execute the attacker’s intended action.