{"id":"CVE-2026-96388","aliases":["DRUPAL-CONTRIB-2026-184","EUVD-2026-107817","GHSA-cj5f-qq9g-fc85"],"status":"published","title":"Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00116,"percentile":0.01634,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2026-09-23T17:14:48Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/tawk_to","fixed_in":["3.0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/tawk_to","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}]}],"products":[{"vendor":"drupal","product":"tawk.to - live chat application"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-184","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96388","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cj5f-qq9g-fc85"},{"url":"https://git.drupalcode.org/project/tawk_to","tags":["web"]},{"url":"https://www.drupal.org/project/tawk_to","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96388.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-96388","title":"Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.","status":"published","published":"2026-10-22T01:21:23.46Z","modified":"2026-10-22T14:15:54.732Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-107817","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.","status":"published","published":"2026-10-22T01:21:23Z","modified":"2026-10-22T14:15:54Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:35.198677Z"}],"ghsa":[{"id":"GHSA-cj5f-qq9g-fc85","title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.","status":"published","published":"2026-10-22T03:33:47Z","modified":"2026-10-22T15:33:48Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:14:16.352322Z"}],"nvd":[{"id":"CVE-2026-96388","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.","status":"published","published":"2026-10-22T02:17:09.117Z","modified":"2026-10-22T16:54:17.39Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-96388","title":"Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.","status":"published","published":"2026-10-22T01:21:23.46Z","modified":"2026-10-28T02:30:45.259576852Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:45:21.262447Z"},{"id":"DRUPAL-CONTRIB-2026-184","description":"This module provides integration of the tawk.to live chat for Drupal sites.\n\nThe module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.","status":"published","published":"2026-09-23T17:14:48Z","modified":"2026-09-23T19:15:04.891141815Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}