A Cross‑Site Request Forgery vulnerability in AuthTake Technology Inc.'s Authtake allows an attacker to forge authenticated requests that change Active Directory passwords. The flaw permits the attacker to alter credentials without the victim’s knowledge, potentially leading to account takeover or privilege escalation. This weakness corresponds to CWE‑352, the classic CSRF vulnerability.

The vulnerability affects AuthTake Technology Inc.'s Authtake product. Versions starting from v1.3 and including all releases before v1.4 are impacted. All subsequent releases, such as v1.4 and later, are not affected.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is currently not available, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be indirect; an attacker must entice a legitimate user, already authenticated to Authtake, to visit a malicious page that submits a forged password‑change request. Once the CSRF token is bypassed, the attacker can set arbitrary passwords for target accounts.