According to the stacktrace you are using both, the CSRF middleware (see src/Application.php) and the CSRF component (see src/Controller/AppController.php) - you should use only one of them! The component is deprecated, so ideally use the middleware.
If you have both enabled, then the CSRF middleware will be invoked first, and after validating the submitted token, it will unset it from the request data, so that the subsequent token check in the CSRF component will fail with the error that you are seeing.
According to the stacktrace you are using both, the CSRF middleware (see
src/Application.php) and the CSRF component (seesrc/Controller/AppController.php) - you should use only one of them! The component is deprecated, so ideally use the middleware.If you have both enabled, then the CSRF middleware will be invoked first, and after validating the submitted token, it will unset it from the request data, so that the subsequent token check in the CSRF component will fail with the error that you are seeing.
See also