My discussion:
Student A: A8 - Cross-Site Request Forgery (CSRF)
Student B: Security Misconfiguration