How do I check whether I am affected by CVE-2026-96388?

- Check the installed version of the Drupal Tawk.to module with `drush pm:list --filter=tawkto` or the module list at /admin/modules - Confirm whether the module is enabled on the site

What is the fix for CVE-2026-96388?

- Update the Drupal Tawk.to module to a release later than `3.0.4`, as published by the module maintainers - unknown whether a patched version number is published in the sources

Who is not affected by CVE-2026-96388?

Not affected if: module-not-installed, patched-version.

Live › vulnerability › CVE-2026-96388

Go to dashboard

medium5.4Package

Drupal Tawk.to live chat module: CSRF lets attackers act as admins

The Drupal Tawk.to live chat module has a cross-site request forgery flaw, so a logged-in site user can be tricked into submitting requests they did not intend. An attacker who lures an authenticated administrator to a malicious page could change the module's settings.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.4

medium

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far4 of 6

missing: versions, primary source

First public: Oct 22, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.1% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker changes chat widget settings through a victim's logged-in session.
CVSS said: 5.4. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Drupal sites that have the Tawk.to live chat module installed at version or earlier. The risk depends on logged-in administrators or editors visiting untrusted pages while signed in. Sites without this module can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-96388

Go to dashboard

medium5.4Package

Drupal Tawk.to live chat module: CSRF lets attackers act as admins

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.4

medium

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far4 of 6

missing: versions, primary source

First public: Oct 22, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.1% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker changes chat widget settings through a victim's logged-in session.
CVSS said: 5.4. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Drupal Tawk.to live chat module: CSRF lets attackers act as admins

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

Drupal Tawk.to live chat module: CSRF lets attackers act as admins

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources