Cookiehanhoan

**Name of the Vulnerable Software and Affected Versions** DeepAI (affected versions not specified) **Description** The endpoint 'https://api.deepai.org/change user email' accepts POST requests without Cross-Site Request Forgery (CSRF) protection. CSRF is a flaw that allows an attacker to induce a user to perform actions they did not intend to do. An attacker could trick an authenticated user into clicking a malicious link, enabling the attacker to change the user's email address and gain full control of the account. **Recommendations** Update the software to the version released on 2026-05-20. As a temporary mitigation, avoid clicking suspicious links while authenticated to the service.