Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

SummaryThe Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

CVE-2026-71416

Headroom is a WebSocket proxy that compresses data before it reaches a large language model. Prior to version 0.35.0 , its WebSocket server fails to validate the Origin header of incoming client WebSocket requests before forwarding them to the upstream server. This allows a Cross-Site WebSocket H...

CVE-2026-71416 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...

CVE-2026-71416 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...

CVE-2026-71416

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the "Origin" header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...

PT-2026-89869

Name of the Vulnerable Software and Affected Versions Headroom versions prior to 0.35.0 Description The Headroom WebSocket server fails to validate the Origin header of incoming client WebSocket requests before forwarding them to the upstream server. This allows malicious WebSocket clients, which...

CVE-2026-71416: Improper Authentication

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...