DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-68923: CVE-2026-68923: Cross-Site Request Forgery (CSRF) in Mobile Security Framework (MobSF)

#security #cve #cybersecurity

CVE-2026-68923: Cross-Site Request Forgery (CSRF) in Mobile Security Framework (MobSF)

Vulnerability ID: CVE-2026-68923
CVSS Score: 6.5
Published: 2026-08-18

CVE-2026-68923 describes a critical security regression in the Mobile Security Framework (MobSF) where vital security middleware, including Cross-Site Request Forgery (CSRF) validation, clickjacking protection, and standard HTTP security controls, was deactivated. The vulnerability arose from a partial migration of Django's middleware settings, which silently omitted security-critical components while preserving legacy definitions. Authenticated sessions on vulnerable instances were left exposed to arbitrary administrative state modifications initiated via cross-site vectors.

TL;DR

A configuration error in MobSF's Django settings omitted global CSRF protections, clickjacking protections, and security headers, enabling remote attackers to execute arbitrary actions on behalf of authenticated administrators.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-352
  • Attack Vector: Network (AV:N)
  • CVSS Score: 6.5
  • EPSS Score: N/A
  • Impact: High Integrity Compromise
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • Mobile Security Framework (MobSF) <= 4.5.0
  • Mobile Security Framework (MobSF): < 4.5.1 (Fixed in: 4.5.1)

Code Analysis

Commit: 62563ca

Remove legacy MIDDLEWARE_CLASSES and restore SecurityMiddleware, CsrfViewMiddleware, and XFrameOptionsMiddleware to active MIDDLEWARE tuple.

-MIDDLEWARE_CLASSES = (...)
MIDDLEWARE = (
+    'django.middleware.security.SecurityMiddleware',
     'mobsf.MobSF.views.api.api_middleware.RestApiAuthMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
-
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
 )
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade MobSF immediately to version 4.5.1 or later.
  • Enable custom firewall rules or reverse proxy protections if local patching is delayed.
  • Implement browser-level mitigations such as restricting cross-origin requests.

Remediation Steps:

  1. Verify current running MobSF version by checking the release manifest or server response headers.
  2. Pull the latest updates from the official repository or container registry.
  3. Apply the patched version v4.5.1 or manually inject CSRF, Security, and XFrameOptions middleware into 'mobsf/MobSF/settings.py'.
  4. Restart the MobSF daemon and verify that CSRF cookies are generated and checked on state-changing endpoints.

References

Read the full report for CVE-2026-68923 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)