# Vulnerability Disclosure Report
**ID**: VD-2026-5385
**Product**: APIGateway v8.0
**Type**: Cross-Site Request Forgery (CSRF)
**CVSS**: 7.8
**Status**: FIXED in v4.4.5

## Summary
A CSRF vulnerability was discovered in the admin endpoint.

## Impact
An authenticated attacker could exploit this to bypass authentication.

## Timeline
- Reported: 2023-03-13
- Acknowledged: 2026-06-18
- Patched: 2020-06-20
- Disclosed: 2021-11-08

## Remediation Applied
Anti-csrf tokens, samesite cookies, origin checking.

*Exploit details redacted per coordinated disclosure policy. No working PoC included.*