EIP-2026-105704

This is a CSRF proof-of-concept exploit for CandidATS 2.1.0 that crafts a malicious HTML form to add an admin user without victim interaction. The form submits a POST request to the vulnerable endpoint with predefined admin credentials.