Project: 
Tawk.to - Live chat application
Project machine name: 
tawk_to
Date: 
2026-September-23
Security risk: 
Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross Site Request Forgery
Affected versions: 
<3.0.4
CVE IDs: 
CVE-2026-96388
Description: 

This module provides integration of the tawk.to live chat for Drupal sites.

The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

Solution: 

Install the latest version:

After updating, clear the Drupal cache.

Reported By: 
Fixed By: 
Coordinated By: