EIP-2026-100972

This exploit demonstrates a CSRF vulnerability in Casdoor v1.901.0, allowing an attacker to change the victim's password by tricking them into submitting a crafted form. The PoC includes an HTML form that submits a POST request to the /api/set-password endpoint without requiring the old password.