CWE-1385 · Access Control
Missing Origin Validation in WebSockets
45CVEs
SortMost likely exploited
45 CVEs with CWE-1385 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-48849Authentication and Authorization IssuesABB · FLXEON · CVSS 9.4 · 2025-01-29 | 9.4 | 0.9% | 2025-01-29 |
| CVE-2025-24964Remote Code Execution when accessing a malicious website while Vitest API server is listeningvitest-dev · vitest · CVSS 9.7 · 2025-02-04 | 9.7 | 0.7% | 2025-02-04 |
| CVE-2025-68930Traccar Missing Origin Validation in WebSocketstraccar · traccar · CVSS 7.1 · 2026-02-23 | 7.1 | 0.6% | 2026-02-23 |
| CVE-2014-125071lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websocketslukehutch · Gribbit · CVSS 5.5 · 2023-01-09 | 5.5 | 0.4% | 2023-01-09 |
| CVE-2023-0957An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket c…Gitpod · Gitpod · CVSS 8.2 · 2023-03-03 | 8.2 | 0.4% | 2023-03-03 |
| CVE-2024-23168Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.No vendor recorded · CVSS 9.8 · 2024-08-15 | 9.8 | 0.4% | 2024-08-15 |
| CVE-2023-49805Uptime Kuma Missing Origin Validation in WebSocketslouislam · uptime-kuma · CVSS 6 · 2023-12-11 | 6.0 | 0.4% | 2023-12-11 |
| CVE-2023-2848Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation.Movim · Movim · CVSS 8 · 2023-09-14 | 8.0 | 0.4% | 2023-09-14 |
| CVE-2026-107858Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development ServerGoogle · Agent Development Kit (ADK) for Java · CVSS 7.2 · 2026-10-23 | 7.2 | 0.4% | 2026-10-23 |
| CVE-2025-52882Claude Code IDE extensions allow websocket connections from arbitrary originsanthropics · claude-code · CVSS 8.8 · 2025-06-24 | 8.8 | 0.4% | 2025-06-24 |
| CVE-2023-30856eDEX-UI cross-site websocket hijacking vulnerability enables remote command executionGitSquared · edex-ui · CVSS 8.3 · 2023-04-28 | 8.3 | 0.3% | 2023-04-28 |
| CVE-2026-57111Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-OriginApache Software Foundation · Apache Helix REST · CVSS 7.5 · 2026-07-09 | 7.5 | 0.3% | 2026-07-09 |
| CVE-2023-26114Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in spe…Coder · code-server · CVSS 8.2 · 2023-03-23 | 8.2 | 0.3% | 2023-03-23 |
| CVE-2023-2850NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user inform…NodeBB · NodeBB · CVSS 4.7 · 2023-07-25 | 4.7 | 0.3% | 2023-07-25 |
| CVE-2026-59804Midscene Bridge Server - Session Hijack via Unauthenticated WebSocketweb-infra-dev · midscene · CVSS 6.8 · 2026-07-08 | 6.8 | 0.3% | 2026-07-08 |
| CVE-2024-51775Apache Zeppelin: Command Injection via CSWSHApache Software Foundation · Apache Zeppelin · CVSS 7.5 · 2025-08-03 | 7.5 | 0.3% | 2025-08-03 |
| CVE-2025-48068Information exposure in Next.js dev server due to lack of origin verificationvercel · next.js · CVSS 2.3 · 2025-05-30 | 2.3 | 0.3% | 2025-05-30 |
| CVE-2026-15580PassPortal browser extension: vault token disclosure via unvalidated postMessageN-able · PassPortal · CVSS 6.9 · 2026-08-21 | 6.9 | 0.2% | 2026-08-21 |
| CVE-2026-22689Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emailsaxllent · mailpit · CVSS 6.5 · 2026-01-10 | 6.5 | 0.2% | 2026-01-10 |
| CVE-2026-85183Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORSAvaiga · taipy · CVSS 9.3 · 2026-09-03 | 9.3 | 0.2% | 2026-09-03 |
| CVE-2026-59950MCP Python SDK: WebSocket server transport does not support Host/Origin validationmodelcontextprotocol · python-sdk · CVSS 7.6 · 2026-07-15 | 7.6 | 0.2% | 2026-07-15 |
| CVE-2026-10054In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) wit…Eclipse Foundation · Eclipse Theia · CVSS 8.8 · 2026-07-03 | 8.8 | 0.2% | 2026-07-03 |
| CVE-2025-56647npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket clie…No vendor recorded · CVSS 6.5 · 2026-02-12 | 6.5 | 0.2% | 2026-02-12 |
| CVE-2025-54289Privilege Escalation via WebSocket Connection Hijacking in LXD Operations APICanonical · LXD · CVSS 7.4 · 2025-10-02 | 7.4 | 0.2% | 2025-10-02 |
| CVE-2026-85267Cross-Site WebSocket Hijacking in Google Cloud ShellGoogle Cloud · Cloud Shell · CVSS 8.7 · 2026-10-20 | 8.7 | 0.2% | 2026-10-20 |
| CVE-2023-2886Cross-Site WebSocket Hijacking in CBOT's ChatbotCBOT · Chatbot · CVSS 4.3 · 2023-05-25 | 4.3 | 0.2% | 2023-05-25 |
| CVE-2026-27977Next.js: null origin can bypass dev HMR websocket CSRF checksvercel · next.js · CVSS 2.3 · 2026-03-17 | 2.3 | 0.2% | 2026-03-17 |
| CVE-2026-18251IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.IBM · i · CVSS 4.3 · 2026-09-14 | 4.3 | 0.2% | 2026-09-14 |
| CVE-2026-125358Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLinkrehan-remade · universal-modder · CVSS 8.1 · 2026-11-09 | 8.1 | 0.2% | 2026-11-09 |
| CVE-2026-109330Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServerJovancoding · Network-AI · CVSS 4.3 · 2026-10-12 | 4.3 | 0.2% | 2026-10-12 |
| CVE-2025-36116IBM Db2 Mirror for i cross-site websocket hijackingIBM · Db2 Mirror for i · CVSS 6.3 · 2025-07-23 | 6.3 | 0.2% | 2025-07-23 |
| CVE-2026-34403Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints0xJacky · nginx-ui · CVSS 5.5 · 2026-04-20 | 5.5 | 0.2% | 2026-04-20 |
| CVE-2026-21883Bokeh server applications have Incomplete Origin Validation in WebSocketsbokeh · bokeh · CVSS 4.5 · 2026-01-08 | 4.5 | 0.2% | 2026-01-08 |
| CVE-2023-32264CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upload arbitrary code and execute it on the client's computer.OpenText · Documentum D2 · CVSS 5.8 · 2024-03-08 | 5.8 | 0.2% | 2024-03-08 |
| CVE-2026-44514Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated userskubetail-org · kubetail · CVSS 6.5 · 2026-05-14 | 6.5 | 0.2% | 2026-05-14 |
| CVE-2026-35589nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)HKUDS · nanobot · CVSS 8 · 2026-04-14 | 8.0 | 0.2% | 2026-04-14 |
| CVE-2026-104380Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_oneNo vendor recorded · CVSS 5.3 · 2026-10-06 | 5.3 | 0.2% | 2026-10-06 |
| CVE-2025-61987GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. do not validate origins in WebSockets. If a user acce…Japan Total System Co.,Ltd. · GroupSession Free edition · CVSS 6.9 · 2025-12-12 | 6.9 | 0.2% | 2025-12-12 |
| CVE-2026-13272Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessIBM · Verify Identity Access · CVSS 5.4 · 2026-09-14 | 5.4 | 0.2% | 2026-09-14 |
| CVE-2026-77363obsidian-tc Streamable HTTP transport permits cross-origin loopback vault accessThe-40-Thieves · obsidian-tc · CVSS 8.8 · 2026-10-12 | 8.8 | 0.2% | 2026-10-12 |
| CVE-2026-126344@hono/node-server: WebSocket upgrade request-target starting with `//` replaces the host in `c.req.url`, bypassing `Origin` checkshonojs · node-server · CVSS 5.4 · 2026-11-12 | 5.4 | 0.2% | 2026-11-12 |
| CVE-2026-112085webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgradeswebpack-dev-server · webpack-dev-server · CVSS 8.2 · 2026-10-22 | 8.2 | 0.1% | 2026-10-22 |
| CVE-2024-8201Cross-Site WebSocket Hijacking Vulnerability in Hitachi Ops Center AnalyzerHitachi · Hitachi Ops Center Analyzer · CVSS 5.4 · 2025-05-16 | 5.4 | 0.1% | 2025-05-16 |
| CVE-2026-1692Missing origin validation in GraphicalData web service requestsarcinfo · PcVue · CVSS 5.3 · 2026-02-26 | 5.3 | 0.1% | 2026-02-26 |
| CVE-2026-67405RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)rabbitmq · rabbitmq-server · CVSS 5.3 · 2026-09-23 | 5.3 | 0.1% | 2026-09-23 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.