EIP-2026-110037

This is a functional CSRF exploit for onArcade v2.4.2, demonstrating how an attacker can trick an admin into adding a new admin user via a crafted HTML form. The exploit leverages the lack of CSRF tokens in the application.