EUVD-2026-110496

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enablin...

CVE-2026-116748

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enablin...

CVE-2026-116748 Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enablin...

Transmission: Remote code execution

Background Transmission is a cross-platform BitTorrent client. Description A vulnerability was discovered in how Transmission handles access control through the X-Transmission-Session-Id. Impact A remote attacker could execute arbitrary RFC commands or consequently conduct a DNS rebinding attack...

transmission-daemon -- vulnerable to dns rebinding attacks

Google Project Zero reports: The transmission bittorrent client uses a client/server architecture, the user interface is the client which communicates to the worker daemon using JSON RPC requests. As with all HTTP RPC schemes like this, any website can send requests to the daemon listening on...