GHSA-hcff-qv74-7hr4 Gokapi has CSRF in Login Endpoint

• Go github.com/forceu/gokapi: < 2.2.3 → fixed in 2.2.3

Summary The login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a session on successful credential validation. *Issue found by aisafe.io* Impact An attacker can force a victim browser into a session associated with an existing user account where the attacker knows the credentials, causing user confusion, activity misattribution, and potential misuse of trusted user actions.