CVE-2026-39371: 
RedwoodSDK vulnerability analysis and mitigation

CVE-2026-39371 is a Cross-Site Request Forgery (CSRF) vulnerability in RedwoodSDK, a server-first React framework, affecting the rwsdk npm package. Server functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method restrictions. The vulnerability affects versions from 1.0.0-beta.50 through 1.0.5 and was published on April 6–7, 2026, with a fix released in version 1.0.6. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, RedwoodJS Advisory).

The root cause is improper HTTP method enforcement at server function dispatch time (CWE-352: Cross-Site Request Forgery). RedwoodSDK's server function dispatcher accepted GET requests for functions intended to be invoked only via POST, meaning any exported function in a "use server" file — including serverAction() handlers — could be triggered by a simple GET navigation. Because browsers automatically attach SameSite=Lax cookies on top-level GET requests, an attacker could craft a URL embedding a known action ID and JSON-encoded arguments; when an authenticated victim visited or was redirected to this URL, the server function executed with the victim's session credentials. No authentication or special privileges are required on the attacker's side — only user interaction (the victim visiting the malicious URL) (GitHub Advisory, RedwoodJS Advisory).

Successful exploitation allows an unauthenticated attacker to trigger state-changing server-side operations — such as data writes, record deletions, or mutations — with the privileges of an authenticated victim, without the victim's knowledge or consent. The integrity and availability impacts are rated High, as attackers can manipulate or destroy application data; confidentiality impact is None, as the attack does not directly expose data to the attacker. Any application using cookie-based authentication and performing state-changing operations in "use server" files is at risk, potentially affecting all users of the vulnerable application (GitHub Advisory, RedwoodJS Advisory).

There is no confirmed in-the-wild exploitation or functional public exploit code for this vulnerability. A GitHub repository (zebbernCVE/CVE-2026-39371) was identified as a purported PoC but was assessed as containing only a README with references and no actual exploit code or reproduction steps (GitHub Advisory). The EPSS score is approximately 0.006% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify a target application built on RedwoodSDK (rwsdk npm package) versions 1.0.0-beta.50 through 1.0.5 that uses cookie-based authentication and exposes state-changing server functions in "use server" files.
2. Enumerate server function action IDs: Analyze the application's JavaScript bundles or network traffic to identify the action IDs assigned to server functions (e.g., serverAction() handlers or bare exported functions in "use server" files).
3. Craft malicious URL: Construct a GET request URL targeting the server function endpoint, embedding the known action ID and any required JSON-encoded arguments as query parameters (e.g., https://target.app/api/server-fn?actionId=<id>&args=<json>).
4. Deliver to victim: Lure an authenticated victim to visit the crafted URL via a phishing link, malicious redirect, or embedded resource (e.g., <img src="..."> or <a href="...">). The victim's browser automatically sends their SameSite=Lax session cookie with the GET request.
5. Achieve unauthorized action: The server dispatches the GET request to the target server function and executes it with the victim's credentials, performing the unintended state-changing operation (e.g., deleting records, modifying data) (GitHub Advisory, RedwoodJS Advisory).

• Network: Unusual GET requests to server function dispatch endpoints (e.g., paths associated with "use server" action IDs) that would normally only receive POST requests; GET requests with JSON-encoded arguments in query parameters originating from unexpected referrers or external domains.
• Logs: Server access logs showing GET requests to server function endpoints returning HTTP 200 (on vulnerable versions) rather than 405 Method Not Allowed; requests with action ID parameters from unfamiliar IP addresses or referrer headers pointing to external sites.
• Application Behavior: Unexpected state changes in the application (e.g., deleted records, modified data) correlated with GET requests in server logs rather than user-initiated POST actions.

The primary remediation is to upgrade the rwsdk npm package to version 1.0.6 or later; no application code changes are required. The fix enforces the declared HTTP method at dispatch time, so GET requests to server functions that require POST now return 405 Method Not Allowed. As an interim workaround for applications that cannot immediately upgrade, consider implementing stricter SameSite=Strict cookie policies to prevent cookies from being sent on cross-site navigations, and add server-side HTTP method validation for all state-changing endpoints (GitHub Advisory, RedwoodJS Advisory).

The advisory was published by RedwoodSDK maintainer justinvdm on April 6, 2026, with credit to researcher zebbern for finding the vulnerability. The disclosure followed standard coordinated vulnerability disclosure practices via GitHub Security Advisories. No significant broader media coverage or notable community debate has been identified beyond routine CVE tracking and aggregator coverage.