CVE-2026-40471 - Vulnerability Analysis

Overview

hackage-server contains a cross-site request forgery vulnerability caused by lack of CSRF protection across endpoints, letting attackers trigger unauthorized actions including package uploads and user account creation, exploit requires victim interaction.

Severity & Score

Impact

Attackers can perform unauthorized administrative actions or create user accounts by exploiting victim's credentials via CSRF.

Mitigation

Update to the latest version with CSRF protections implemented.

References

• https://osv.dev/vulnerability/HSEC-2026-0002

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner