An attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated