What type of vulnerability/attack is it when the malicious person forces the user's browser to send an authenticated request to a server?

In a CSRF attack, the attacker exploits the trust a web server has in the user's authenticated session by embedding a malicious request in a page or link that the victim's browser executes while already authenticated. Because the browser automatically appends session cookies, the server processes the forged request as legitimate. The key distinguishing factor is that the request originates from the victim's own browser using their credentials.

Cross-site scripting (XSS) injects malicious scripts into a trusted website that then execute in other users' browsers, rather than forging authenticated requests.

Session hijacking involves stealing or intercepting an active session token to impersonate a user, which is a different mechanism from forcing the browser to send a crafted request.

Server-side request forgery (SSRF) forces the server itself to make requests to internal or external resources, not the client's browser.