The flaw resides in the loginSubmit API of kalcaddle kodbox 1.64, where tampering with the third argument triggers a CSRF condition that an attacker can exploit remotely. The vendor was notified but did not respond, and the exploit code is publicly available. A successful exploitation would let an adversary force a victim’s browser to submit requests that the service will accept as legitimate, potentially altering or deleting data, changing user settings, or escalating privileges, depending on the target function exposed by the API.

Kalcaddle’s Kodbox 1.64 is affected. The vulnerability is located in the file /workspace/source-code/plugins/oauth/controller/bind/index.class.php, part of the loginSubmit API. No other affected versions are disclosed.

The CVSS score of 2.3 suggests low severity, but the public availability of the exploit and the remote nature of the attack raise concern. EPSS data is not provided and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires the victim to be authenticated to the site, making it an authenticated CSRF scenario. The owner of the affected service can mitigate risk by applying a patch or making the API resistant to unauthorized request forging.