DeepAI Change User Email Endpoint Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability has been identified in the DeepAI endpoint 'https://api.deepai.org/change_user_email'. This endpoint accepts POST requests without any CSRF protection. As a result, an attacker could potentially trick a logged-in user into clicking a malicious link, allowing the attacker to change the user's email address and take over their account.

Impact

Exploitation of this vulnerability allows for account takeover by changing the user's email address.

Remediation

Users are advised to update to the version released on 2026-05-20, which addresses this vulnerability.