{"id":"CVE-2026-1169","aliases":["EUVD-2026-3205","GHSA-25w3-vxr6-gm5r"],"status":"published","title":"birkir prime cross-site request forgery","description":"A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0024,"percentile":0.15293,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352","CWE-862"],"published":"2026-01-19T17:32:05Z","modified":"2026-10-28T02:31:04Z","products":[{"vendor":"birkir","product":"prime"}],"references":[{"url":"https://vuldb.com/?id.341763","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://vuldb.com/?ctiid.341763","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/?submit.731287","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/birkir/prime/issues/547","tags":["exploit","issue-tracking","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/birkir/prime/","tags":["product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1169","tags":["advisory"]},{"url":"https://github.com/birkir/prime"},{"url":"https://github.com/advisories/GHSA-25w3-vxr6-gm5r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1169.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-1169","title":"birkir prime cross-site request forgery","description":"A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-01-19T17:32:05.542Z","modified":"2026-02-23T08:47:53.591Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-352","CWE-862"],"updated_at":"2026-11-02T14:20:00.879257Z"}],"euvd":[{"id":"EUVD-2026-3205","description":"A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-01-19T17:32:05Z","modified":"2026-02-23T08:47:53Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:34.555054Z"}],"ghsa":[{"id":"GHSA-25w3-vxr6-gm5r","title":"A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability...","description":"A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-01-19T18:30:28Z","modified":"2026-02-23T09:31:21Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:06:19.172449Z"}],"nvd":[{"id":"CVE-2026-1169","description":"A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-01-19T18:16:04.583Z","modified":"2026-06-17T10:15:15.363Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352","CWE-862"],"updated_at":"2026-11-02T14:12:04.066712Z"}],"osv":[{"id":"CVE-2026-1169","title":"birkir prime cross-site request forgery","description":"A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-01-19T17:32:05.542Z","modified":"2026-10-28T02:31:04.695855191Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-352","CWE-862"],"updated_at":"2026-11-02T15:44:57.008854Z"}]}}