CVE-2026-33920: Cross-site request forgery in the Guardian/CMC login before 26.3.0
A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Guardian/CMCto a version that resolves this vulnerability.Fixed in 26.3.0
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a valid Guardian/CMC account and must persuade a victim to interact with a crafted request. The victim is then unknowingly authenticated into the attacker’s account.
Which login methods are affected?
Both standard login and SAML login functionality are affected.
What is the practical impact if exploitation succeeds?
Actions performed by the victim while logged into the attacker’s account are recorded as actions by that attacker. This compromises the integrity of the audit trail rather than exposing the victim’s own account.
Which versions are affected?
Guardian/CMC login versions before 26.3.0 are affected.