CVE-2026-111753
Description
A flaw was found in @angular/common. Due to discrepancies between internal URL validation and browser URL parsing standards, outgoing requests to external destinations can be misclassified as same-origin requests. A remote attacker who induces an application to send a request to an attacker-controlled URL can capture sensitive Cross-Site Request Forgery (CSRF) tokens. This token disclosure allows the attacker to bypass CSRF defenses and execute unauthorized actions within the victim's session.
Statement
This vulnerability is rated as Moderate impact because successful exploitation depends on specific preconditions, notably that an application must dispatch state-changing HTTP requests to untrusted or attacker-controlled destinations. In standard Red Hat application deployments, front-end clients communicate with well-defined same-origin backend endpoints rather than dynamic external URLs. Additionally, token leakage can only be leveraged if the external destination exposes permissive cross-origin resource sharing policies for custom authentication headers.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
