murtaza-nasir Speakr up to 0.8.20 CSRF Protection src/app.py csrf_exempt_for_api_tokens token cross-site request forgery

Summaryinfo

A vulnerability categorized as problematic has been discovered in murtaza-nasir Speakr up to 0.8.20. The affected element is the function csrf_exempt_for_api_tokens of the file src/app.py of the component CSRF protection. Such manipulation of the argument token leads to cross-site request forgery. This vulnerability is uniquely identified as CVE-2026-54510. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in murtaza-nasir Speakr up to 0.8.20. Affected by this issue is the function csrf_exempt_for_api_tokens of the file src/app.py of the component CSRF Protection. The manipulation of the argument token with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. CVE summarizes:

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrf_exempt_for_api_tokens() before_request hook in src/app.py calls csrf.exempt(view_func), permanently adding the selected view to Flask-WTF's process-global exemption set. The is_token_authenticated() function in src/utils/token_auth.py calls extract_token_from_request() and treats any present token, including request.args.get('token'), as authenticated without hashing the token, querying the database, or checking validity. A network-reachable attacker can therefore send a false token to disable CSRF protection for the targeted view for the worker lifetime. Because the exemption applies to the view function across HTTP methods, a cross-origin GET to /account with a query token can poison CSRF state for a later state-changing POST without triggering CORS preflight. This browser sequence requires attacker-controlled content on a sibling subdomain under the documented cookie conditions. The bypass can modify profile data, custom prompts, transcription settings, preferences, and administrative status through routes such as admin_toggle_admin. The change_password route also skips current-password verification when current_user.password is empty, allowing the chain to set a local password on an SSO-only account and bypass SSO. This issue is fixed in version 0.8.21-alpha.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54510 since 06/15/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 0.8.21-alpha eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• murtaza-nasir

Name

• Speakr

Version

• 0.8.0
• 0.8.1
• 0.8.2
• 0.8.3
• 0.8.4
• 0.8.5
• 0.8.6
• 0.8.7
• 0.8.8
• 0.8.9
• 0.8.10
• 0.8.11
• 0.8.12
• 0.8.13
• 0.8.14
• 0.8.15
• 0.8.16
• 0.8.17
• 0.8.18
• 0.8.19
• 0.8.20

Website

• Product: https://github.com/murtaza-nasir/speakr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion