CVE-2025-5988

This issue is classified as Moderate because the exploitation conditions significantly limit its practicality and impact in typical deployments. Successful exploitation requires the attacker to first obtain a valid CSRF form token tied to the victim’s session, which is generally protected by browser same-origin policies and modern CSRF mitigations—making token theft non-trivial without an existing compromise or major misconfiguration. Additionally, the gateway is still performing Referer checks when TLS edge termination is in place, which, while not as strict as Origin validation, reduces exposure in many real-world setups. The need for a valid authenticated session and precise token alignment means the attacker cannot simply trick a user into visiting a malicious site and execute arbitrary state-changing requests; they must overcome multiple layered controls.