CWE-1385: Missing Origin Validation in WebSockets
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
Also known as Cross-Site WebSocket hijacking (CSWSH).
A kind of CWE-346 Origin Validation Error.
From the CWE List. © The MITRE Corporation.
Newest
- intranda goobi-viewer-core Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation 6.5 Medium
- google agent development kit (adk) for java Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server 7.2 High
- webpack-dev-server webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades 8.2 High
- google cloud cloud shell Cross-Site WebSocket Hijacking in Google Cloud Shell 8.7 High
- the-40-thieves obsidian-tc obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access 8.8 High
- jovancoding network-ai Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer 5.3 Medium
- No product listed Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one 5.3 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) 5.3 Medium
- edwardkim rhwp rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages 4.7 Medium
- ibm security verify access, verify identity access, security verify access container +1 more +3 more Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access 5.4 Medium
- ibm i IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. 4.3 Medium
- headroom labs headroom Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH) 8.8 High
- santifer career-ops career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution 5.8 Medium
- avaiga taipy Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS 9.3 Critical
- n-able passportal PassPortal browser extension: vault token disclosure via unvalidated postMessage 6.9 Medium
- lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more MCP Python SDK: WebSocket server transport does not support Host/Origin validation 7.6 High
- apache helix, apache software foundation helix rest +1 more Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin 7.5 High
- web-infra-dev midscene Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket 7.6 High
- eclipse foundation theia, the eclipse foundation eclipse theia +1 more In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level au… 8.8 High
- cline Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability 9.6 Critical
- kubetail-org kubetail, github.com/kubetail-org/kubetail/modules/cli, github.com/kubetail-org/kubetail/modules/dashboard +2 more Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users 6.5 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 more Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints 5.5 Medium
- hkuds nanobot nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update) 8.0 High
- arcinfo pcvue Missing origin validation in GraphicalData web service requests 5.3 Medium
- storybook, red hat enterprise linux 10, enterprise linux 9 +2 more +4 more Storybook Dev Server Vulnerable to WebSocket Hijacking 8.9 High
- traccar Traccar Missing Origin Validation in WebSockets 7.1 High
-
@farmfe/corenpm @farmfe/core is Missing Origin Validation in WebSocket 6.5 Medium - axllent mailpit Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails 6.5 Medium
- bokeh Bokeh server applications have Incomplete Origin Validation in WebSockets 4.5 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 more GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and... 6.9 Medium
- vercel next.js Next.js: null origin can bypass dev HMR websocket CSRF checks 2.3 Low
- canonical lxd Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API 7.4 High
- komari-monitor komari Komari Allows Cross-site WebSocket Hijacking 8.6 High
- apache zeppelin Apache Zeppelin: Command Injection via CSWSH 5.3 Medium
- ibm db2 mirror for i IBM Db2 Mirror for i cross-site websocket hijacking 6.3 Medium
- anthropics claude-code Claude Code IDE extensions allow websocket connections from arbitrary origins 8.8 High
- vercel next.js Information exposure in Next.js dev server due to lack of origin verification 2.3 Low
- hitachi ops center analyzer Cross-Site WebSocket Hijacking Vulnerability in Hitachi Ops Center Analyzer 5.4 Medium
- vitest-dev vitest Remote Code Execution when accessing a malicious website while Vitest API server is listening 9.7 Critical
- abb flxeon Authentication and Authorization Issues 8.8 High
- vitejs vite Vite allows any websites to send any requests to the development server and read the response 6.5 Medium
- xiexe xsoverlay Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious... 9.8 Critical
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 more Platform: insecure websocket used when interacting with eda server 8.1 High
- emc documentum d2 CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The... 5.8 Medium
- uptime.kuma uptime kuma, dockge.kuma dockge, louislam uptime-kuma +2 more Uptime Kuma Missing Origin Validation in WebSockets 6.0 Medium
- nodebb Unintentional leakage of private information via cross-origin websocket session hijacking 4.7 Medium
- movim Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This... 8.0 High
- cbot core, panel, chatbot +2 more Cross-Site WebSocket Hijacking in CBOT's Chatbot 4.3 Medium
- edex-ui project edex-ui eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution 8.3 High
- coder code-server code-server vulnerable to Missing Origin Validation in WebSockets 8.2 High
- Show olderLoading…