Forced purchases via tokenless /buy requests
Published Jul 6, 2026 · Updated Jul 6, 2026
Cross-site request forgery in ecommerceFlask allows remote attackers to force authenticated users into purchases through /buy. The /buy POST handler accepts product and quantity fields under a cookie-backed session without a CSRF token or Origin or Referer validation, then deducts the user's balance and inserts an order. The victim must be signed in and induced to load attacker-controlled content; the demonstrated request creates an unauthorized order and reduces the victim's application balance.
Summary
What happened
Cross-site request forgery in ecommerceFlask allows remote attackers to force authenticated users into purchases through /buy. The /buy POST handler accepts product and quantity fields under a cookie-backed session without a CSRF token or Origin or Referer validation, then deducts the user's balance and inserts an order. The victim must be signed in and induced to load attacker-controlled content; the demonstrated request creates an unauthorized order and reduces the victim's application balance.
The record
- CVE
- CVE-2026-14800
- Published
- Jul 6, 2026
- Updated
- Jul 6, 2026
- Vendor
- Hamza Azam
- Product
- ecommerceFlask
- Classifications
- CWE-352, T1204.001
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Jul 6, 2026CVE publishedPublication date reported by the CVE source.
- Jul 6, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=cb7d9e24c30a99379651b7493b32048126ef402b
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- Tokenless /buy CSRF proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo