Veracode static analysis reports [HttpPost] actions of a controller that do not have the [ValidateAntiForgeryToken] annotation on them. You may find more information about Cross-Site Request Forgery protection in .NET applications here: https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-6.0.

Unfortunately, sometimes the line number information for these actions is not in the debug symbols and so the fallback is to report it on the controller constructor line. Luckily when this happens, the name of the action is able to be captured and this is reported in the "Attack Vector" field in the flaw details that can be found on the Triage Flaws view. An example of this can be seen here, where "write" is the attack vector: