Cross-Site Request Forgery attacks can affect any application that processes POST requests. Flask does not add CSRF tokens automatically. Flask-WTF handles this.