PatchClock

PHP security digest · 23 Sep 2026

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attac...

Unrated CVE-2026-96388

Package
drupal/tawk_to
Fixed in
3.0.4
Published
Wed 23 Sep 2026, 18:14 LisbonUpdated Mon 26 Oct 2026, 02:25 Lisbon

In plain words

The tawk.to live chat integration for Drupal does not sufficiently validate certain requests. An attacker may be able to trick an authenticated user into performing unintended actions through cross-site request forgery (CSRF).

Am I affected?

Look for drupal/tawk_to and its version in composer.lock. The advisory lists 3.0.4 as fixed but gives no affected version range, so it does not identify which other versions are affected. The version is all there is to check locally: no configuration, feature or database condition is named.

What to do

Check which version you have, then update to a fixed release for your branch (3.0.4):

composer show drupal/tawk_to | grep versions
composer update drupal/tawk_to

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module provides integration of the tawk.to live chat for Drupal sites.

The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.