Hi, how does WordPress mitigate CSRF-vulnerabilities in wp-login.php?

Can you explain that a little better?

Edit: I mean, have you found something that would indicate that’s true?

Edit: I mean, have you found something that would indicate that’s true?

I did a vulnerability scan, and it complained that the the login-form was missing a CSRF-token.

I couldn’t find any _wpnounce or csrftoken field in the form or header, and the tokens I found didn’t seem to be primarily used for CSRF mitigation.

Can you explain that a little better?

CSRF is explained here: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

https://support.detectify.com/customer/portal/articles/1969819-login-csrf

they give this information link also:
https://security.stackexchange.com/questions/59411/how-to-protect-against-login-csrf