diff --git a/CHANGELOG.md b/CHANGELOG.md
index db13153..7af4974 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 CHANGELOG
 ===================
+## v2.12.2 - (2026-08-05)
+### BC BREAK
+- The login form now submits a CSRF token. You must enable `enable_csrf: true` on the `form_login` of the admin firewall in your `security.yaml` config, otherwise authentication will fail.
+
+### Fixed
+- `templates/security/login.html.twig` Add missing CSRF token on login form to fix CWE-352
+- `templates/empty_layout.html.twig` Add missing `integrity`/`crossorigin` attributes on the Iconify CDN script to fix CWE-345
+- `templates/admin/documentation/markdown.html.twig` Pin `marked` CDN script to a fixed version and add `integrity`/`crossorigin` attributes to fix CWE-345
+
 ## v2.12.1 - (2026-05-19)
 ### Removed
 - Removed redundant Composer dependencies duplicated from `smartbooster/core-bundle`
diff --git a/templates/admin/documentation/markdown.html.twig b/templates/admin/documentation/markdown.html.twig
index 0210fab..74df242 100644
--- a/templates/admin/documentation/markdown.html.twig
+++ b/templates/admin/documentation/markdown.html.twig
@@ -67,7 +67,7 @@
 
 {% block javascripts %}
     {{ parent() }}
-    <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/marked@15.0.12/marked.min.js" integrity="sha384-948ahk4ZmxYVYOc+rxN1H2gM1EJ2Duhp7uHtZ4WSLkV4Vtx5MUqnV+l7u9B+jFv+" crossorigin="anonymous"></script>
     <script type="application/javascript">
       document.addEventListener('DOMContentLoaded', function() {
         const content = {{ markdown_content|json_encode|raw }}
diff --git a/templates/empty_layout.html.twig b/templates/empty_layout.html.twig
index 7e4ec58..56a29de 100644
--- a/templates/empty_layout.html.twig
+++ b/templates/empty_layout.html.twig
@@ -18,7 +18,7 @@
     {# no parent() to disable javascript on empty_layout to prevent loading jquery #}
 
     {# https://iconify.design/docs/iconify-icon/#registering-the-web-component #}
-    <script src="https://code.iconify.design/iconify-icon/2.1.0/iconify-icon.min.js"></script>
+    <script src="https://code.iconify.design/iconify-icon/2.1.0/iconify-icon.min.js" integrity="sha384-GPb5RlngihS9H0z1D137JsvzmeZ7tCpWEF4t5YDoTZyMsPP8S7h7vFDh4XhheU83" crossorigin="anonymous"></script>
 {% endblock %}
 
 {% block sonata_wrapper %}
diff --git a/templates/security/login.html.twig b/templates/security/login.html.twig
index 07ca66b..e0414ac 100644
--- a/templates/security/login.html.twig
+++ b/templates/security/login.html.twig
@@ -15,6 +15,7 @@
         <div class="login-box-body">
             {% block smartsonata_box_header %}<h1 class="text-center">SMART SONATA</h1>{% endblock %}
             <form action="{{ security_login_check_url }}" method="post">
+                <input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}">
                 <div class="form-group has-feedback">
                     <input type="text" name="_username" class="form-control" autocomplete="off" placeholder="{{ 'login.label_username'|trans({}, 'security') }}" required />
                     <span class="glyphicon glyphicon-user form-control-feedback"></span>