The REST server for Apache Juneau accepts a "content" query parameter that, when present, fully replaces the HTTP request body regardless of the method. This option is enabled by default for all HTTP methods, including GET. A malicious site can therefore deliver an attacker's chosen body to an endpoint without triggering CORS preflight or relying on the original method, which defeats security controls that depend on method or content‑type checks. Through such a forged request an attacker can cause state‑changing operations to execute under the victim’s authenticated session, potentially compromising application integrity.

Apache Software Foundation’s Apache Juneau framework, in all releases up to and including version 9.2.0, is affected. The vulnerability originates from the default‑enabled ability to override the request body through the "content" query parameter. Systems running these or earlier releases without disabling this feature are vulnerable.

The CVSS score of 10 indicates critical severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a classic CSRF scenario: an authenticated user’s browser follows a malicious link or loads a page from a third‑party site that supplies the forged request body via the content parameter. Because the switch is on by default, no special privileges or additional data are required, making exploitation straightforward for attackers that can lure victims to a crafted URL.