CVE-2026-39371

HighCVSS 8.1

Published: 07/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

RedwoodSDK from 1.0.0-beta.50 to 1.0.5 allows server functions from 'use server' files to be invoked via GET requests, bypassing intended HTTP method. In cookie-authenticated apps with SameSite=Lax, CSRF attacks can trigger state changes.

Risk Assessment

An attacker can use cross-site GET to invoke state-changing functions, potentially leading to unauthorized actions in the application.

Recommendation

Upgrade RedwoodSDK to version 1.0.6 or later.

Other vulnerabilities in RedwoodSDK

CVE-2026-42190Medium
In RedwoodSDK versions 1.0.0-beta.50 to before 1.2.3, server actions enforce HTTP method but not origin validation. A request from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached.

Original NVD description (English source)

RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files. This vulnerability is fixed in 1.0.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS