CVE-2025-46721

CVE-2025-46721 is a Cross-Site Request Forgery (CSRF) bypass vulnerability affecting nosurf versions prior to 1.2.0, a Go middleware for CSRF protection. The vulnerability, rated Medium severity (CVSS 6.1), stems from nosurf's miscategorization of incoming requests as plain-text HTTP, leading to a failure in Referer header origin checks. An attacker with control over content on the target site or a subdomain can exploit this to manipulate cookies, acquire or override CSRF tokens, and forge requests on a user's behalf, resulting in potential information disclosure and integrity compromise. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.