The Waku JavaScript framework suffers from a Cross‑Site Request Forgery flaw that allows an attacker to trigger authenticated POST requests to server action endpoints from a different origin. Without validating the Origin or Sec‑Fetch‑Site header, any state‑changing server action exposed via 'use server' can be invoked with the victim’s session cookies, leading to potentially unauthorized modifications, deletions, or other state changes, classified as CWE‑352.

The vulnerability affects all Waku deployments that use the wakujs:waku package prior to the 1.0.0‑beta.1 release. Versions earlier than that release lack origin validation in the RSC request dispatcher and are thus vulnerable.

The flaw carries a CVSS score of 6.5, indicating moderate risk, and its EPSS score is not available; it is not listed in the CISA Knowledge‑Exploited Vulnerabilities catalog. An attacker who can embed a malicious page under a different domain can send a plain‑text POST that bypasses CORS preflight, causing the victim's browser to execute a privileged state‑changing action. Because the request uses the victim’s credentials and no preflight is triggered, the attack is stealthy and can be automated once the target is susceptible.