Web vulnerability where an attacker tricks a victim’s browser into sending an authenticated request to a target site, where the user is logged in, and performs unwanted actions.
This can be done when the browser automatically includes the victim’s cookies/session tokens.
Prevention
This can be prevented by requiring a unique token for each session or request.
Functional protections, like requiring the user to input their password before changing it, can also help mitigate the impact.