Yeah, that was what I thought too. It was a very weird situation. And it was the only one of its kind that I found: I found other vulnerabilities, but none wher

Yeah, that was what I thought too. It was a very weird situation. And it was the only one of its kind that I found: I found other vulnerabilities, but none where CSRF tokens were presented but not validated. Edit: I should clarify that this is my blog post ;)