CVE-2026-55883

Tilt HUD WebSocket (/ws/view) in Tilt is affected from 0.24.0 through 0.37.3. CSRF-protected, but the token is served from an unauthenticated /api/websocket_token endpoint and the upgrader accepts connections without an Origin header, enabling network-reachable attackers to read session state, Ti...