CWE-1385 · weakness in Access Control
Missing Origin Validation in WebSockets
45 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 45 is a mark on the map. Named now: 1 to 26, most at risk first.
- Authentication and Authorization Issues
- Remote Code Execution when accessing a malicious website while Vitest API server is listening
- Traccar Missing Origin Validation in WebSockets
- lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets
- An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket c…
- Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.
- Uptime Kuma Missing Origin Validation in WebSockets
- Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation.
- Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server
- Claude Code IDE extensions allow websocket connections from arbitrary origins
- eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution
- Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin
- Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in spe…
- NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user inform…
- Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket
- Apache Zeppelin: Command Injection via CSWSH
- Information exposure in Next.js dev server due to lack of origin verification
- PassPortal browser extension: vault token disclosure via unvalidated postMessage
- Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails
- Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
- MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) wit…
- npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket clie…
- Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
- Cross-Site WebSocket Hijacking in Google Cloud Shell
- Cross-Site WebSocket Hijacking in CBOT's Chatbot
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.