CVE-2026-27632: Talishar CSRF Vulnerability

CVE-2026-27632 Overview

CVE-2026-27632 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Talishar, a fan-made Flesh and Blood trading card game project. The application lacks CSRF protections on critical state-changing endpoints, specifically within SubmitChat.php and other game interaction handlers. By failing to require unique, unpredictable session tokens, the application allows third-party malicious websites to forge requests on behalf of authenticated users, leading to unauthorized actions within active game sessions.

Critical Impact

Authenticated users playing active game sessions may have unauthorized actions performed on their behalf if they interact with a malicious website while playing, potentially disrupting gameplay or manipulating game state.

Affected Products

• Talishar (Flesh and Blood fan project) - versions prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48

Discovery Timeline

• 2026-02-25 - CVE CVE-2026-27632 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27632

Vulnerability Analysis

This CSRF vulnerability exists because the Talishar application does not implement anti-CSRF tokens or other request validation mechanisms on state-changing endpoints. The vulnerable endpoints, including SubmitChat.php and various game interaction handlers, accept and process requests without verifying that they originated from a legitimate user action within the application itself.

For successful exploitation, an attacker would need to know both the gameName and playerID parameters for the target player. Additionally, the victim must be actively playing a game session and browse to or interact with an attacker-controlled malicious website during that time. These prerequisites significantly limit the practical exploitability of this vulnerability.

The vulnerability follows the classic CSRF pattern where the absence of request origin validation allows cross-origin requests to perform actions with the victim's authenticated session.

Root Cause

The root cause is the failure to implement CSRF protection mechanisms (CWE-352). The application does not generate or validate unpredictable session-specific tokens for state-changing operations. Without these tokens, the server cannot distinguish between legitimate requests initiated by the user and forged requests from malicious third-party sites.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must craft a malicious webpage containing forged requests targeting Talishar endpoints. When an authenticated user who is actively playing a game visits this malicious page, their browser automatically includes session cookies with the forged requests. If the attacker has obtained or guessed the victim's gameName and playerID, the forged requests will execute within the victim's game session.

The attack complexity is high due to the requirement of knowing session-specific identifiers and the need for the victim to be actively engaged in a game while also visiting the malicious site.

Detection Methods for CVE-2026-27632

Indicators of Compromise

• Unexpected game actions or chat messages appearing in active sessions that were not initiated by the player
• Server logs showing requests to SubmitChat.php or game interaction endpoints with referrer headers from external domains
• Multiple rapid state-changing requests originating from different source IPs for the same game session

Detection Strategies

• Monitor HTTP referrer headers for requests to state-changing endpoints; legitimate requests should originate from the Talishar application domain
• Implement logging for all game state modifications and review for anomalous patterns
• Deploy web application firewall (WAF) rules to detect and block cross-origin POST requests to sensitive endpoints

Monitoring Recommendations

• Enable detailed access logging for all PHP endpoints handling game state changes
• Configure alerts for requests to game endpoints lacking proper origin or referrer headers
• Review application logs periodically for signs of automated or scripted request patterns

How to Mitigate CVE-2026-27632

Immediate Actions Required

• Update Talishar to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48 or later, which contains the security fix
• If immediate update is not possible, consider temporarily restricting access to the application or implementing network-level protections
• Advise users to avoid browsing untrusted websites while actively playing games

Patch Information

The vulnerability has been fixed in commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48. This commit implements proper CSRF protections for the affected endpoints. Users and administrators should update their Talishar installation to include this commit or any subsequent version that incorporates this fix. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Deploy a reverse proxy or WAF that validates request origins and blocks cross-origin POST requests to sensitive endpoints
• Implement SameSite cookie attributes (Strict or Lax) at the web server or application level to limit cookie transmission on cross-site requests
• Educate users to log out of active game sessions before browsing other websites