CVE-2025-68930

🔍 CVE-2025-68930 の分析: Traccar における WebSocket ハイジャックの脆弱性 CVE-2025-68930 は、オープンソースの GPS トラッキングシステム Traccar における クロスサイト WebSocket ハイジャック CSWSH の重大な脆弱性 を明らかにします。以下に、重要な詳細を示します: 🛡️ 脆弱性の詳細 影響を受けるエンドポイント : /api/socket。 根本原因 : WebSocket の ハンドシェイク 中に Origin ヘッダーの検証が欠如していること。 悪用のメカニズム : 1...

rabbitmq-server: RabbitMQ: Cross-Site WebSocket Hijacking via missing Origin header validation

A flaw was found in RabbitMQ's Web-MQTT and Web-STOMP handlers. These handlers do not properly validate the Origin header during a WebSocket upgrade. When specific non-default configurations are enabled, such as usehttpauth=true for Web-STOMP or sslcertlogin=true for both plugins, an attacker can...

CVE-2026-71416

Headroom is a WebSocket proxy that compresses data before it reaches a large language model. Prior to version 0.35.0 , its WebSocket server fails to validate the Origin header of incoming client WebSocket requests before forwarding them to the upstream server. This allows a Cross-Site WebSocket H...

CVE-2026-71416 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...

CVE-2026-71416 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...

CVE-2026-85183 Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-85183

Taipy (a Python web application framework) through version 4.1.1 misconfigures its socket.io server with a wildcard CORS origin and the credential flag enabled. This allows any web page to establish credentialed WebSocket connections to a victim's Taipy application, enabling attackers to open soc...

CVE-2026-85183 Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-74802

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

CVE-2026-74802

SiYuan versions before 3.7.4 set the WebSocket CheckOrigin handler to unconditionally return true on the admin-only /ws/network/proxy endpoint, allowing cross-site WebSocket hijacking. A malicious webpage can make the victim's SiYuan kernel proxy arbitrary network traffic, enabling authenticated ...

CVE-2026-74802

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

EUVD-2026-60085

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

PT-2026-76601

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

Cross-Site WebSocket Hijacking (CSWSH)

Spring for GraphQL is vulnerable to Cross-Site WebSocket Hijacking CSWSH. The vulnerability is due to insufficient protection of WebSocket connections, which allows an attacker to trick an authenticated user into visiting a malicious webpage and execute arbitrary GraphQL operations using the...

Bokeh server applications have Incomplete Origin Validation in WebSockets

This vulnerability allows for Cross-Site WebSocket Hijacking CSWSH of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability...

PT-2026-48626

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.0.0 through 1.0.6 Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3 Description Applications using the WebSocket...

CVE-2026-41700: Origin Validation Error

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials...

CVE-2026-35589

nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking CSWSH vulnerability exists in the bridge's WebSocket server in bridge/src/server.ts, resulting from an incomplete remediation of CVE-2026-2577. The original fix changed the binding from 0.0.0.0 to...

CVE-2026-44985

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: funcr http.Request bool return true , accepting upgrade requests from any origin. Combined with the JWT cookie using SameSite: Lax, this enables...

CVE-2026-44985

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: funcr http.Request bool return true , accepting upgrade requests from any origin. Combined with the JWT cookie using SameSite: Lax, this enables...