CVE-2026-114456

Multiple Snowflake client drivers using the authenticator=externalbrowser SSO flow are vulnerable to an Origin Validation Error (CWE-346) . The local loopback callback listener fails to verify a CSRF state value and reflects arbitrary request Origin headers into CORS responses. This allows an att...

CVE-2026-114456 Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers

Multiple Snowflake client drivers implementing the authenticator=externalbrowser single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener...

Missing Origin Validation

obsidian-tc is vulnerable to missing Origin and DNS-rebinding validation. The vulnerability is due to missing Host, Origin, and DNS-rebinding validation in the Streamable HTTP transport when authentication is disabled, which allows an attacker to exploit a malicious webpage to gain unrestricted...

CVE-2026-107858

The Google Agent Development Kit (ADK) for Java development web server (ADK Web) is vulnerable to Cross-Site WebSocket Hijacking (CWE-1385) and Permissive CORS (CWE-942). The issue stems from missing origin validation in the /run_live WebSocket endpoint and a default Access-Control-Allow-Origin: ...

CVE-2026-107858 Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

Missing Origin Validation in WebSockets CWE-1385 and Permissive Cross-domain Policy with Untrusted Domains CWE-942 in the development web server ADK Web in Google Agent Development Kit ADK for Java com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plug...

npm: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

npm: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites vulnerability discovered by ? in WordPress npm storybook versions = 8.0.0, 8.6.19...

GHSA-F2PH-CMG5-WXC8 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of...

EUVD-2026-107393

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

CVE-2026-104380: Missing Origin Validation in WebSockets

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in psserveone. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The...

CVE-2026-67405

RabbitMQ messaging and streaming broker is vulnerable to a Cross-Site WebSocket Hijacking (CSWSH) flaw in its Web-MQTT and Web-STOMP handlers. The vulnerability exists because these handlers fail to validate the Origin header during a WebSocket upgrade. If non-default configurations are enabled—s...

CVE-2026-67405: Missing Origin Validation in WebSockets

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...

CVE-2026-13272

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...

CVE-2026-13272 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...

CVE-2026-13272: Missing Origin Validation in WebSockets

IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems...

CVE-2026-18251: Missing Origin Validation in WebSockets

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin...

GHSA-RQFV-2MW9-78G2 MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

Summary In SSE/HTTP transport mode, mysqlmcpserver constructs SseServerTransport without passing securitysettings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service...

CVE-2026-85183: Missing Origin Validation in WebSockets

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and actio...

CVE-2026-74867

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

CVE-2026-59804: Missing Origin Validation in WebSockets

Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-origin WebSocket connection to the local Socket.IO server, whi...

Missing Origin Validation in WebSockets

Overview @theia/terminal is a Theia - Terminal Extension Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets via the shell-terminal and terminals/:id WebSocket endpoints when origin validation is bypassed due to missing or manipulated headers. An attacker c...