CVE-2026-45430: Backdrop CMS Salesforce Module CSRF Flaw

CVE-2026-45430 Overview

CVE-2026-45430 is a Cross-Site Request Forgery (CSRF) vulnerability in the Salesforce module for Backdrop CMS. Versions before 1.x-1.0.1 fail to properly use a random state parameter to protect the OAuth authorization flow. The missing state parameter allows attackers to trick authenticated users into linking attacker-controlled Salesforce accounts to the victim's Backdrop CMS session. Successful exploitation can lead to account compromise and unauthorized data access between the two integrated platforms.

Critical Impact
Attackers can hijack the OAuth authorization flow to bind victim Backdrop CMS accounts to attacker-controlled Salesforce accounts, enabling data theft and account takeover.

Affected Products

Backdrop CMS Salesforce module versions before 1.x-1.0.1
Backdrop CMS installations integrating with Salesforce via the affected module
Web applications relying on the module's OAuth authorization flow

Discovery Timeline

2026-05-12 - CVE-2026-45430 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-45430

Vulnerability Analysis

The Salesforce module for Backdrop CMS implements an OAuth 2.0 authorization flow to connect Backdrop sites with Salesforce instances. OAuth specifications require a random, unpredictable state parameter on authorization requests. This parameter binds the authorization response to the originating session and defends against CSRF attacks [CWE-352].

The affected module does not generate or validate a cryptographically random state value. As a result, the OAuth callback endpoint accepts authorization codes regardless of which user session initiated the flow. An attacker can craft a malicious link or page that triggers the callback with an attacker-controlled authorization code.

Root Cause

The root cause is the absence of a per-session random state parameter in the OAuth authorization request and a corresponding validation step in the callback handler. Without this binding, the module cannot verify that the authorization response corresponds to a request the legitimate user initiated.

Attack Vector

Exploitation requires user interaction. An authenticated Backdrop CMS administrator must visit an attacker-controlled page or click a crafted link while authenticated. The attacker first initiates an OAuth flow against their own Salesforce account and captures the resulting authorization code. The attacker then delivers a forged callback URL to the victim. When the victim's browser submits the callback to the Backdrop CMS site, the module exchanges the attacker's code for tokens and associates the attacker's Salesforce account with the victim's Backdrop session. Subsequent data synchronization between the two platforms flows through the attacker's account.

The vulnerability is described in the Backdrop CMS Security Advisory.

Detection Methods for CVE-2026-45430

Indicators of Compromise

Unexpected linking of Salesforce accounts to Backdrop CMS administrator users in module configuration logs
OAuth callback requests to the Backdrop Salesforce module endpoint lacking a state parameter or containing a static value
Outbound API traffic from Backdrop CMS to unfamiliar Salesforce org IDs or instance URLs
Audit log entries showing Salesforce account re-authorization without a corresponding user-initiated session

Detection Strategies

Inspect web server access logs for requests to the module's OAuth callback path that originate from external referrers
Review the module configuration database table for changes to stored Salesforce credentials or refresh tokens that do not correlate with administrative activity
Monitor for HTTP requests carrying authorization codes without an accompanying random state query parameter

Monitoring Recommendations

Enable detailed logging on the Backdrop CMS Salesforce module and forward logs to a centralized SIEM for correlation
Alert on changes to OAuth refresh tokens or connected Salesforce instance URLs within the module configuration
Track administrative session activity around OAuth callback events to identify cross-site request patterns

How to Mitigate CVE-2026-45430

Immediate Actions Required

Upgrade the Backdrop CMS Salesforce module to version 1.x-1.0.1 or later
Revoke and re-issue any Salesforce OAuth tokens issued by affected Backdrop CMS installations
Audit existing Salesforce account linkages within Backdrop CMS and remove any that cannot be attributed to legitimate administrator activity

Patch Information

The Backdrop CMS project has released version 1.x-1.0.1 of the Salesforce module, which introduces a random state parameter in the OAuth authorization flow and validates it on callback. Administrators should apply this update immediately. Full remediation details are available in the Backdrop CMS Security Advisory.

Workarounds

Disable the Salesforce module until the patched version 1.x-1.0.1 can be deployed
Restrict access to the OAuth callback endpoint using web server rules that require an authenticated administrative session
Require administrators to re-authenticate before performing OAuth linking operations

bash

# Update the Backdrop CMS Salesforce module to the patched release
cd /path/to/backdrop/modules/contrib
rm -rf salesforce
wget https://github.com/backdrop-contrib/salesforce/archive/refs/tags/1.x-1.0.1.tar.gz
tar -xzf 1.x-1.0.1.tar.gz
mv salesforce-1.x-1.0.1 salesforce
drush ev "backdrop_flush_all_caches();"