Cross-site request forgery (CSRF) vulnerability