What is a CSRF attack, and why does it work even without the attacker knowing your password?

CSRF exploits the browser's automatic behavior of attaching a site's cookies to every request sent to that site, regardless of what triggered the request. An attacker crafts a page that silently sends a request to the target site; the victim's browser attaches their existing valid session cookie automatically, so the forged request looks authenticated — the attacker never needs to see, steal, or know the victim's actual credentials.