CVE-2026-73423

A flaw was found in Astro. The composable astro/hono pipeline can bypass origin checks, which are designed to prevent unauthorized cross-site requests. This occurs because the security.checkOrigin mechanism is not consistently applied when middleware is absent or misordered in the pipeline. A...

Duplicate Advisory: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3cc2-h3v6-rqpq. This link is maintained to preserve external references. Original Description SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/pro...

PT-2026-76601

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site WebSocket hijacking issue exists in the admin-only '/ws/network/proxy' endpoint. The flaw occurs because the CheckOrigin function is configured to unconditionally return true, effectively...

CVE-2026-73423 Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware primitive, while actions and pages can dispatch to user code independently. Mounting actions before middleware, as in the...

Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication

Summary The WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: funcr http.Request bool return true , accepting upgrade requests from any origin. Combined with the JWT cookie using SameSite: Lax, this enables Cross-Site WebSocket Hijacking CSWSH — even when authentication is...

PT-2026-39679

Name of the Vulnerable Software and Affected Versions Dozzle versions prior to 10.5.2 Description The WebSocket upgrader for the '/exec' and '/attach' endpoints accepts upgrade requests from any origin because it uses a custom CheckOrigin function that always returns true. When combined with the...

Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

Summary All WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking CSWSH. Combined with the fact that authentication tokens are stored in browser cookies set via JavaScript without HttpOnly or...