highCVSS 8.8CWE-352A01:2021 – Broken Access Control

Routers, IoT, and localhost

Top-level form navigation reaches private addresses that Local Network Access does not gate, and Basic/NTLM/client-cert auth is ambient and SameSite-immune.

Where CSRF never got harder

Everything that made CSRF difficult in 2026 — Lax defaults, third-party cookie blocking, partitioning — is about cookies. The internal-network attack surface is largely untouched by all of it, for two reasons:

The credentials often are not cookies. HTTP Basic, Digest, NTLM, Negotiate/Kerberos, and TLS client certificates are all ambient: the browser attaches them automatically, and no cookie attribute governs them. SameSite has nothing to say about a Basic auth realm.
The devices have no defences. A consumer router, a printer, a NAS, an IP camera, a building-management controller — these ship with no CSRF token, no Origin check, and frequently a state-changing GET API. Many are never patched at all.

Add a third: the credentials are often default. admin:admin is still the modal router password, and an attack that has to guess one credential pair is not much of an obstacle.

So a page on the public internet can reconfigure devices on the visitor's home or corporate LAN. This is one of the highest-impact CSRF surfaces remaining, and it is routinely out of scope for web assessments while being entirely in scope for real attackers.

Local Network Access, and its gap

Browsers have been tightening access from public pages to private addresses. Chromium's Local Network Access (the successor to Private Network Access) requires a permission prompt before a page on a public origin may make a subresource request to a private or loopback address.

That closes the <img>-tag version of this attack. It does not close the important one:

Local Network Access gates subresource requests. It does not gate top-level navigations.

An auto-submitting form is a top-level navigation. It still reaches http://192.168.1.1/, with Basic auth attached, and no prompt.

This matters twice over, because top-level navigation is also the only shape that still carries a Lax cookie. So the one delivery that survives modern cookie policy is the same one that survives Local Network Access. If you take one thing from this guide: use the form.

Also note what counts as private: RFC 1918 ranges, 127.0.0.0/8, localhost, .local names, and link-local addresses. Cloud metadata endpoints like 169.254.169.254 are link-local and reachable the same way, which is where this surface starts overlapping with SSRF.

The attack

HTMLVulnerable
<!doctype html>
<html>
  <body>
    <!-- A top-level form navigation to an RFC 1918 address. No Local Network
         Access prompt, because this is a navigation rather than a
         subresource. If the device uses Basic auth and the browser has
         cached the realm -- or the device uses no auth at all, which is
         common on the LAN side -- this simply works.

         Changing the primary DNS server is the highest-value single change:
         it puts the attacker in the path of every name lookup on the network
         for every device, which is why the availability and confidentiality
         impacts are both High in the CVSS above. -->
    <form id="poc" action="http://192.168.1.1/setup.cgi" method="POST">
      <input type="hidden" name="dns_primary" value="203.0.113.10" />
      <input type="hidden" name="apply" value="1" />
    </form>
    <script>document.getElementById('poc').submit()</script>
  </body>
</html>

The non-cookie credentials

Credential	Attached automatically?	Governed by SameSite?
Session cookie	Yes	Yes — this is the only row SameSite covers
HTTP Basic / Digest	Yes, once cached for the realm	No
NTLM / Negotiate (Kerberos)	Yes, transparently on a domain-joined machine	No
TLS client certificate	Yes, once selected for the origin	No
No authentication at all	N/A — common on LAN device admin panels	No
Authorization: Bearer	No — the page's own script must add it	N/A — not CSRF-able

Corporate intranets

The enterprise version of this, and the reason it is worth raising in an internal assessment:

Windows Integrated Authentication (NTLM or Kerberos) is ambient. On a domain-joined machine, a browser in the Local Intranet zone authenticates to internal sites transparently — no prompt, no cookie, no SameSite. An employee who visits an attacker-controlled page can therefore have authenticated requests issued to every internal application they can reach.

What makes this worse than the equivalent cookie case:

No cookie policy applies, so subresource requests work too, not just navigations. <img> tags are back on the table.
Internal applications are the least hardened, frequently legacy, and often lack any CSRF token because "it is internal".
The credential cannot be scoped down by the application. It is the OS's, not the app's.

The defences are the same as anywhere — a token, and an Origin or Sec-Fetch-Site check — and the message worth delivering to a client is that "internal only" is not a mitigation for CSRF. The attacker never needs network access; they only need an employee to open a page.

Prevention

For device and internal-application vendors:

Implement a CSRF token, and check Origin/Sec-Fetch-Site. The fact that a device sits on a LAN is not a boundary — the attacker's page is what reaches it.
Never change state on GET. Router firmware is full of setup.cgi?setting=value.
Force a password change on first setup, and do not ship a shared default.
Reject requests whose Host header is not an address you expect, which blocks DNS-rebinding variants of the same attack.
Prefer a token over Basic auth, so the credential is not ambient in the first place.

For organisations:

Treat "internal only" as no mitigation. Require CSRF defences on internal applications in the same way as external ones.
Segment: developer workstations and user desktops should not reach device management interfaces directly.
Change default credentials on everything, and audit for them.

For developers, on your own machine:

Bind development servers to 127.0.0.1 rather than 0.0.0.0, and require a token on any local endpoint that can execute code or write files.
Assume any page you visit can issue a top-level navigation to localhost.

The Cookie Model

Cookies are scoped by domain, not origin: who can set one, who receives one, and what __Host-, Secure, Path, and Partitioned actually change.

GET Deliveryhigh

img, script, link, scripted link clicks, and top-level navigation — and why only the last one still carries a cookie.

Auto-Submitting Formshigh

The urlencoded and multipart form: the only primitive that issues a cross-site request with a body, ambient credentials, and no preflight.

CSRF in 2026

What still works and what died with Lax-by-default — the honest, browser-by-browser exploitability verdict, plus the techniques that are now purely historical.

Origin, Referer, and Fetch Metadata

Sec-Fetch-Site, Mode and Dest, Origin checks done correctly, the missing-header decision, and Resource Isolation Policy.

Defense in Depth

The layering order — SameSite=Lax, __Host- prefix, Fetch Metadata rejection, then a token — plus re-authentication for high-value operations.