The vulnerability in Tawk.to Live chat application is a classic Cross‑Site Request Forgery. An attacker who tricks a legitimate user into loading a crafted page can cause the user to unknowingly send authenticated requests that change settings or perform actions on the chat platform. This flaw can lead to unauthorized configuration changes or other privileged operations, degrading the integrity of the service while it remains within the victim’s session. Component affected is the Drupal‑based Tawk.to Live chat application. Versions from the initial 0.0.0 release up to and including 3.0.4 inherit the CSRF weakness, so any deployment using those releases is vulnerable. This vulnerability has a CVSS score of 5.4 and an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog. Because CSRF requires only a user’s browser and is ordinarily easy to trigger, the practical risk remains high, especially if the chat application includes administrative or high‑privilege operations. Attackers can exploit the flaw remotely via a malicious link, making it a low‑barrier risk for any exposed instance of Tawk.to.

The vulnerable component is Drupal's Tawk.to Live chat application. Versions 0.0.0 through 3.0.4 are affected. Any installation of Tawk.to within this version range should be considered compromised unless a patch has been applied.

The exploitation path involves sending a forged request from a malicious site to the Tawk.to application while a user is authenticated. No authentication or privileged access is required beyond the user’s existing session. This vulnerability has a CVSS score of 5.4 and an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog, indicating a moderate risk with a low but non‑zero likelihood of exploitation in environments where the chat interface is publicly exposed.