CWE-1385.

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

• CWE-346
• CWE-1385

<1.3.1 · fixed in 1.3.1

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

• intranda goobi-viewer-core
• Authentication bypass
• Broken access control

Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

• Google Agent Development Kit (ADK) for Java
• Authentication bypass
• CWE-942

webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

• webpack-dev-server
• CWE-346
• CWE-1385

Cross-Site WebSocket Hijacking in Google Cloud Shell

• Google Cloud Cloud Shell
• CWE-1385

Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer

• Jovancoding Network-AI
• CWE-1385

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

• CWE-1385

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

• Authentication bypass
• CWE-1385

<0.35.0 · fixed in 0.35.0

RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

• rabbitmq-server
• CWE-1385

rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

• edwardkim rhwp
• Information disclosure
• Server-side request forgery (SSRF)

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

• IBM Verify Identity Access
• IBM Security Verify Access
• CWE-1385

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

• i
• CWE-1385

career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

• santifer career-ops
• Cross-site request forgery (CSRF)
• CWE-1385

Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

• Avaiga taipy
• CWE-1385

PassPortal browser extension: vault token disclosure via unvalidated postMessage

• N-able PassPortal
• CWE-1385

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

• CWE-346
• CWE-1385

<1.28.1 · fixed in 1.28.1

Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin

• Apache Software Foundation Apache Helix REST
• CWE-1385

Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket

• web-infra-dev midscene
• Authentication bypass
• CWE-1385

Missing authentication in Eclipse Foundation Eclipse Theia

• Eclipse Foundation Eclipse Theia
• Authentication bypass
• CWE-1385

Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

• Authentication bypass
• CWE-1385

<=2.13.0 · no fixed version yet

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

• CWE-1385

<0.16.0 · fixed in 0.16.0

Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

• Cross-site request forgery (CSRF)
• CWE-1385

<1.9.10-0.20260316053337-1a9cd29a3082 · fixed in 1.9.10-0.20260316053337-1a9cd29a3082

nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)

• HKUDS nanobot
• CWE-1385

Next.js: null origin can bypass dev HMR websocket CSRF checks

• CWE-1385

>=16.0.1, <16.1.7 · fixed in 16.1.7

Storybook Dev Server is Vulnerable to WebSocket Hijacking

• Other injection
• Cross-site scripting (XSS)

>=8.1.0, <8.6.17 || >=8.7.0-alpha.0, <9.1.19 || >=10.0.0-beta.0, <10.2.10 · fixed in 8.6.17, 9.1.19, 10.2.10

Missing origin validation in GraphicalData web service requests

• arcinfo PcVue
• CWE-1385

Traccar Missing Origin Validation in WebSockets

• traccar
• CWE-1385

@farmfe/core is Missing Origin Validation in WebSocket

• CWE-1385

<1.7.6 · fixed in 1.7.6

Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails

• CWE-1385

<0.0.0-20260110031614 || >=1.2.6, <1.28.2 · fixed in 0.0.0-20260110031614, 1.28.2

Bokeh server applications have Incomplete Origin Validation in WebSockets

• CWE-1385

<3.8.2 · fixed in 3.8.2

Japan Total System Co.,Ltd. GroupSession Free edition: GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3…

• Japan Total System Co.,Ltd. GroupSession Free edition
• Japan Total System Co.,Ltd. GroupSession byCloud
• CWE-1385

Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API

• CWE-1385

>=0.0.0-20200331193331-03aab09f5b5c, <0.0.0-20250827065555-0494f5d47e41 || >=4.0, <5.21.4 || >=6.0, <6.5 · fixed in 0.0.0-20250827065555-0494f5d47e41, 5.21.4, 6.5

Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability

• CWE-1385

>=0.11.1, <0.12.0 · fixed in 0.12.0

IBM Db2 Mirror for i cross-site websocket hijacking

• IBM Db2 Mirror for i
• CWE-1385

Claude Code Improper Authorization via websocket connections from arbitrary origins

• Broken access control
• CWE-1385

>=0.2.116, <1.0.24 · fixed in 1.0.24

Information exposure in Next.js dev server due to lack of origin verification

• CWE-1385

>=13.0, <14.2.30 || >=15.0.0, <15.2.2 · fixed in 14.2.30, 15.2.2

Cross-Site WebSocket Hijacking Vulnerability in Hitachi Ops Center Analyzer

• Hitachi Ops Center Analyzer
• CWE-1385

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

• CWE-1385

<=0.0.125 || >=1.0.0, <1.6.1 || >=2.0.0, <2.1.9 || >=3.0.0, <3.0.5 · fixed in 1.6.1, 2.1.9, 3.0.5

Authentication and Authorization Issues

• ABB FLXEON
• CWE-1385

Websites were able to send any requests to the development server and read the response in vite

• CWE-346
• CWE-350

<4.5.6 || >=5.0.0, <5.4.12 || >=6.0.0, <6.0.9 · fixed in 4.5.6, 5.4.12, 6.0.9

Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.

• CWE-1385

CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2.

• OpenText Documentum D2
• CWE-1385

Uptime Kuma Missing Origin Validation in WebSockets

• louislam uptime-kuma
• CWE-1385

Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability.

• Movim
• CWE-1385

Unintentional leakage of private information via cross-origin websocket session hijacking

• CWE-346
• CWE-1385

<2.8.13 || >=3.0.0, <3.1.3 · fixed in 2.8.13, 3.1.3

Cross-Site WebSocket Hijacking in CBOT's Chatbot

• CBOT Chatbot
• CWE-1385

eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

• GitSquared edex-ui
• CWE-346
• CWE-1385

code-server vulnerable to Missing Origin Validation in WebSockets

• CWE-346
• CWE-1385

<4.10.1 · fixed in 4.10.1

An issue was discovered in Gitpod versions prior to release-2022.11.2.16.

• Gitpod
• CWE-1385

lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets

• lukehutch Gribbit
• CWE-1385