CVE-2025-27792 Opal vulnerable to CSRF protection bypass
Attackers can bypass CSRF protections in Opal by dropping the referrer header, allowing unauthorized actions on behalf of authenticated users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27792?
CVE-2025-27792 is a high-severity vulnerability in obiba opal, published on 11 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery (CSRF) were insufficient application-wide. The referrer header is checked, and if it is invalid, the server returns 403. However, the referrer header can be dropped from CSRF requests using `<meta name="referrer" content="never">`, effectively bypassing this protection. Version 5.1.1 contains a patch for the issue.
Weakness: CWE-352
Which versions are affected by CVE-2025-27792?
How do I fix CVE-2025-27792?
No fix has been published for CVE-2025-27792 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-27792 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27792 exists.
Sources
Also known as AZL-62429, GHSA-27vw-29rq-c358.