Description
The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.
Published: 2026-05-12
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 12 May 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 12 May 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Backdropcms
Backdropcms backdrop-contrib/salesforce
Vendors & Products Backdropcms
Backdropcms backdrop-contrib/salesforce

Tue, 12 May 2026 05:45:00 +0000

Type Values Removed Values Added
Title Cross‑Site Request Forgery Vulnerability in Backdrop CMS Salesforce Module

Tue, 12 May 2026 04:15:00 +0000

Type Values Removed Values Added
Description The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L'}

Subscriptions

Backdropcms Backdrop-contrib/salesforce
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-05-12T12:59:07.153Z

Reserved: 2026-05-12T04:06:23.682Z

Link: CVE-2026-45430

cve-icon Vulnrichment

Updated: 2026-05-12T12:57:48.842Z

cve-icon NVD

Status : Deferred

Published: 2026-05-12T04:16:28.027

Modified: 2026-05-13T15:43:05.440

Link: CVE-2026-45430

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-12T09:21:57Z

Weaknesses