An application validates a CSRF token by checking that req.body.csrf_token === req.session.csrf_token. A developer notices this check is missing on one API endpoint. What risk does this introduce on that endpoint?

• A.The endpoint is vulnerable to CSRF: a malicious page on another origin can submit a form or make a fetch request to this endpoint using the victim's credentials (cookies), performing state-changing actions without their consent
• B.The endpoint exposes the session ID in the response (a leaked token), letting any scripts on the page read it: the risk is session hijacking through XSS rather than forged requests
• C.The endpoint accepts unauthenticated callers (the session cookie is no longer checked): the risk is data exposure to anonymous users, with each response returning other accounts' records
• D.The endpoint is open to SQL injection (the token is concatenated into the query): the risk is a database dump through the csrf_token field, with no link to the victim's cookies