"We run a non-profit summer camp and hired Ricochet to design our camper and staff database from scratch. Their initial design was custom fit to suit our needs and as those needs have evolved the helpful staff at Ricochet have insured that timely changes keep our database up to date and running smoothly. Thanks for the fantastic service and personal attention, it's made a huge difference for our camp!"
—Chrissie Endler, Camp del Corazon

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

Wed, 2026-09-23 10:14 — Anonymous (not verified)

Project: Tawk.to - Live chat applicationProject machine name: tawk_toDate: 2026-September-23Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryAffected versions: <3.0.4CVE IDs: CVE-2026-96388Description: This module provides integration of the tawk.to live chat for Drupal sites.
The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.Solution: Install the latest version:

Upgrade to tawk.to 3.0.4.

After updating, clear the Drupal cache.Reported By:

Tin Nguyen Huu (s4m0y3d)

Fixed By:

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Damien McKenna (damienmckenna) of the Drupal Security Team
Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2026-184

Search form

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184