The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.
CVSS 3.1HIGH 7.1·Network·No auth·User interaction·EPSS 0.00154·Published 2026-05-12·Fixed in 1.x-1.0.1CWE-352