CVE-2026-89279
6.5MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on integrity
- Weakness
- CWE-352
Impact
Remote attackers can force authenticated users into submitting unauthorized requests to enable encryption brute-forcing attacks. The victim must be tricked into visiting a malicious link or web page while authenticated.
Root cause
Missing CSRF protection on critical endpoints allows cross-origin requests to trigger brute-force operations against encryption keys.
Affected systems
AuthTake Technology Inc. Authtake versions v1.3 before v1.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Fix & remediation
Upgrade Authtake to version v1.4 or later. No interim mitigation or workaround is provided in the advisory.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake: from v1.3 before v1.4.