What type of vulnerability/attack is it when the malicious person forces the user's browser to send an authenticated request to a server?

In a CSRF attack, the attacker crafts a malicious request (such as a hidden form or image tag) that the victim's browser automatically sends to a target site where the victim is already authenticated. Because the browser attaches session cookies automatically, the server cannot distinguish the forged request from a legitimate one, allowing the attacker to perform actions as the victim without stealing credentials.

Cross-site scripting (XSS) involves injecting malicious scripts into web pages that execute in other users' browsers, targeting the client side - it does not force the browser to send authenticated requests to a server.

Session hijacking involves stealing or intercepting an active session token so the attacker can impersonate the user directly, rather than forcing the victim's own browser to send the request.

Server-side request forgery (SSRF) causes the server itself to make requests to internal or external resources on the attacker's behalf, not the user's browser.