Settings

Email notifications (GET-based CSRF)

The toggle is a plain link — a state change over GET, so an <img> on any page flips it with no token: <img src="/m05/account/notify?on=1">

Change password (token robustness matrix)

This form does carry a CSRF token, but the server never enforces it properly. Your session token is csrf-demo-8f14e45fceea. Try the four abuses (the PoC Tester automates them): drop the field, blank it, replay it, or swap in carol's token csrf-carol-1f3870be274f. Every one is accepted.

Recovery email (no Origin/Referer check)

The server never checks Origin/Referer, so a request that openly declares a foreign origin still mutates the recovery address. Prove it with curl: curl -H "Origin: https://evil.example" -d "recovery_email=evil@evil.example" /m05/account/recovery

Language (SameSite gap)

A state change that succeeds while carrying your session cookie on a cross-site request is the SameSite finding — a SameSite=Strict cookie would have been withheld. The PoC Tester issues the cross-site-shaped request for you.