The vulnerability is a login cross‑site request forgery in the static credentials callback. An attacker can construct a request that forces the victim’s browser to authenticate as an arbitrary user, potentially enabling session hijack or unauthorized account activity. The weakness allows exploitation without requiring prior authentication, exposing the application to account takeover risks.

Basecamp Upright, specifically the version corresponding to commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f. The issue resides in the static credentials callback route in the sessions controller.

The CVSS score is 8.8, indicating a high‑severity vulnerability, and the EPSS score is <1%, showing a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The exploit requires a victim to visit a crafted page that triggers the static credential callback, so user interaction is needed. Because the injected request can cause a user to authenticate as another account, the potential impact is moderate to high if the application uses these static credentials for privileged access. The known exploit path indicates that defenses against cross‑site request forgery are essential.