Is CVE-2026-33920 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-33920?

CVE-2026-33920 has a CVSS v3 severity of LOW (3.5).

Back

CVE-2026-33920

Description

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.