EUVD-2026-102605

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELSTESTCONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the quer...

CVE-2026-111443

Wheels versions 4.0.6 through 4.1.2 contain a vulnerability allowing an unauthenticated client to switch a request into a separate test application context in production environments. This can be triggered by providing an X-Wheels-Test-Context header, a WHEELS_TEST_CONTEXT cookie, or by including...