Product
Transmission versions prior to 4.1.3 contain a permissive CORS vulnerability in the RPC server that allows unauthorized origins to capture the X-Transmission-Session-Id token and execute arbitrary RPC commands.