🔄 06 — Cross-Site Request Forgery
0/3 solved
🔑 Hard — Token Not Session-Bound
CSRF token exists but isn't bound to the user session. Log in as a different user, get their token, and use it to forge requests as another user.
Your CSRF token:
9636980d7cd815b7898780bf6c310d64Log in as one user to get a valid token. Then use that same token in a CSRF attack targeting a different user — the token passes because it's validated against the DB, not against the session.