The vulnerability resides in the DeepAI endpoint https://api.deepai.org/change_user_email, which accepts POST requests without any CSRF protection. When a logged‑in user is tricked into visiting a malicious link, an attacker can forge a request that changes the user’s email address. The attacker then gains control of that account, potentially allowing access to the user’s data and any services that rely on that account. The weakness is identified as a classic CSRF flaw (CWE‑352).

The affected product is the DeepAI API hosted on api.deepai.org. The issue applies to all affected API versions prior to the fix released on May 20 2026; no specific version numbers are listed in the CVE data.

The CVSS score of 2.3 indicates a low severity vulnerability. No EPSS score is provided, so the current probability of exploitation cannot be determined from this data. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known high‑profile exploitation. The likely attack vector is CSRF, requiring a user to be authenticated and to click a malicious link or visit a compromised site. The absence of CSRF tokens makes the attack trivial once the user is tricked, but the overall impact remains limited to account takeover, not influencing broader system integrity or availability.