CVE-2026-39371

RedwoodSDK versions 1.0.0-beta.50 through 1.0.5 contain a critical cross-site request forgery vulnerability that allows server functions exported from "use server" files to be invoked via GET requests, bypassing their intended HTTP method restrictions. In cookie-authenticated applications, this enables attackers to trigger state-changing operations through cross-site GET navigations, as browsers automatically send SameSite=Lax cookies on top-level requests. The vulnerability affects all server functions, including both serverAction handlers and bare exported functions. The vulnerability carries a CVSS score of 8.1 (High severity) with a network attack vector, low attack complexity, and no privilege requirements. While it requires user interaction, the impact is significant, with potential for integrity compromise and availability disruption. The attack can be executed remotely with minimal effort, and affected applications require no special conditions beyond cookie-based authentication to be vulnerable. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities catalog. The EPSS score of 0.00006 indicates minimal community attention relative to other CVEs. RedwoodSDK released version 1.0.6 as a patch, and organizations should prioritize upgrading to this version or later to remediate the risk.