CVE-2026-39371 - Vulnerability Analysis

Overview

RedwoodSDK 1.0.0-beta.50 to 1.0.5 contains a broken access control vulnerability caused by server functions exported from "use server" files being invokable via GET requests, letting attackers trigger state-changing functions via cross-site GET navigations, exploit requires cookie-authenticated applications.

Severity & Score

Impact

Attackers can trigger state-changing functions via cross-site GET requests, potentially causing unauthorized actions in authenticated sessions.

Mitigation

Update to version 1.0.6 or later.

References

• https://github.com/redwoodjs/sdk/security/advisories/GHSA-x8rx-789c-2pxq

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner