[MEDIUM] AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

PKSA-1q5j-gcpm-qr2y CVE-2026-96629 GHSA-wm25-49w3-5qrg

Affected package: adminneo-org/adminneo

Affected version: <5.5.1

Reported by:
GitHub