—

DRUPAL-CONTRIB-2026-184

Details

This module provides integration of the tawk.to live chat for Drupal sites.

The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/tawk_to

Introduced in: 0Fixed in: 3.0.4

Upgrade drupal/tawk_to to 3.0.4 or newer (ecosystem packagist:https://packages.drupal.org/8).

References

https://www.drupal.org/sa-contrib-2026-184[WEB]