Skip to content
CVE-2026-121451: High-Risk CSRF Vulnerability in AB Download Manager

CVE-2026-121451: High-Risk CSRF Vulnerability in AB Download Manager

First seen 3 Nov 2026, 23:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 23:49 UTC
  • •CVE-2026-121451 affects AB Download Manager before version 1.11.2.
  • •The vulnerability allows remote file writing via CSRF attacks.
  • •Users are urged to upgrade or disable browser integration to mitigate risks.

AB Download Manager versions prior to 1.11.2 have a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to write files to arbitrary paths via an unauthenticated browser-integration API. A malicious web page can exploit this by sending a crafted request to the /start-headless-download endpoint, potentially executing code on user login. Users of the software, especially on shared or business- workstations, are primarily affected. The vulnerability has a CVSS score of 8.7, indicating high severity. As of now, there is no confirmation of active exploitation or proof-of-concept (PoC) code available. Users are advised to upgrade to the fixed version or disable browser integration until then.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-11-03
CVE-2026-121451 published
AB Download Manager disclosed a CSRF vulnerability allowing remote file writing, affecting versions before 1.11.2.
Redpacketsecurity
2026-11-03
CVE-2026-121451 reported
Sploitus reported the same CSRF vulnerability in AB Download Manager, confirming the risk of code execution on user login.
Sploitus

More articles in this cluster (5)

Following this threat?

Track CVE-2026-121451 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

What versions of AB Download Manager are affected?
All versions before 1.11.2 are affected by this vulnerability.
Is there any evidence of exploitation in the wild?
Currently, there is no confirmed active exploitation or proof-of-concept code available for this vulnerability.
What should users do to protect themselves?
Users should upgrade to version 1.11.2 or later, or disable the browser integration feature until an upgrade can be performed.