Clockwork Web prior to 0.1.2, when Rails prior to 5.2 is used, allows CSRF.
clockwork web project clockwork web