CVE-2026-54510— Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook
Quick assessment
Affected
murtaza-nasir speakr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Speakr 是一个用于转录音频录音的个人自托管 Web 应用。在 0.8.21-alpha 之前， 中的 钩子会调用 ，这将永久地将选定的视图添加到 Flask-WTF 的全局进程中豁免集合中。 中的 函数会调用 ，并将任何存在的令牌（包括 ）视为已认证，而不对令牌进行哈希处理、查询数据库或检查其有效性。因此，网络可达的攻击者可以发送一个虚假的令牌，以禁用目标视图在整个工作进程生命周期内的 CSRF 保护。由于该豁免适用于视图函数的所有 HTTP 方法，对 的跨源 GET 请求（携带查询参数中的令牌）可以污染 C
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54510
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook
Source: CVE Program / CVE List V5
Vulnerability Description
Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrf_exempt_for_api_tokens() before_request hook in src/app.py calls csrf.exempt(view_func), permanently adding the selected view to Flask-WTF's process-global exemption set. The is_token_authenticated() function in src/utils/token_auth.py calls extract_token_from_request() and treats any present token, including request.args.get('token'), as authenticated without hashing the token, querying the database, or checking validity. A network-reachable attacker can therefore send a false token to disable CSRF protection for the targeted view for the worker lifetime. Because the exemption applies to the view function across HTTP methods, a cross-origin GET to /account with a query token can poison CSRF state for a later state-changing POST without triggering CORS preflight. This browser sequence requires attacker-controlled content on a sibling subdomain under the documented cookie conditions. The bypass can modify profile data, custom prompts, transcription settings, preferences, and administrative status through routes such as admin_toggle_admin. The change_password route also skips current-password verification when current_user.password is empty, allowing the chain to set a local password on an SSO-only account and bypass SSO. This issue is fixed in version 0.8.21-alpha.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| murtaza-nasir | speakr | < 0.8.21-alpha | - |
|
II. Public POCs for CVE-2026-54510
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54510
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54510 (1)
Other References for CVE-2026-54510 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-54510
No comments yet