Forced login via missing session-bound CSRF protection

Login CSRF in Gokapi before 2.2.3 allows remote authenticated users to force victim browsers into attacker-known accounts. The login handler parses credential-bearing form values and creates a session after validating them, without verifying a CSRF token bound to the victim browser context. The attacker must know valid account credentials and induce victim browser interaction; resulting actions can be misattributed to the victim and performed within the attacker-known session.