CVE-2026-121451

Summary

AB Download Manager before 1.11.2 exposes an unauthenticated browser-integration API endpoint (/start-headless-download) vulnerable to CSRF, allowing attackers to trick users into writing arbitrary files to disk, including placing malicious payloads in startup folders for code execution.

Exploitability

Exploitation requires user interaction (e.g., visiting a malicious webpage) and relies on the victim's browser sending a forged request to the vulnerable endpoint without authentication or CSRF protection.

Blast radius

Successful exploitation enables remote code execution upon user login, compromising confidentiality, integrity, and availability of the affected system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AB Download Manager version 1.11.2 or later, which patches the CSRF vulnerability in the unauthenticated API endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.