CWE-1385 · 36 records

Missing Origin Validation in WebSockets

CVEs in this class

36 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2014-125071No exploit	lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websocketsgribbit project · gribbit · CWE-1385 Pre-auth	Critical9.8	—	0.4%	Jan 9, 2023
39Monitor	CVE-2024-23168No exploit	Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting iCWE-1385 pre-auth RCE	Critical9.8	—	0.4%	Aug 15, 2024
38Monitor	CVE-2023-0957No exploit	An issue was discovered in Gitpod versions prior to release-2022.11.2.16.gitpod · gitpod · CWE-1385 Pre-auth	Critical9.6	—	0.4%	Mar 3, 2023
37Monitor	CVE-2023-26114No exploit	Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.coder · code-server · CWE-1385 Pre-auth	Critical9.3	—	0.3%	Mar 23, 2023
37Monitor	CVE-2026-85183No exploit	Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORSavaiga · taipy · CWE-1385 Pre-auth CSRF	Critical9.3	—	0.2%	Sep 3, 2026
37Monitor	CVE-2026-35589No exploit	nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)nanobot · nanobot · CWE-1385 Pre-auth	Critical9.3	—	0.1%	Apr 14, 2026
35Monitor	CVE-2024-48849Proof of concept	Authentication and Authorization Issuesabb · flxeon · CWE-1385 Pre-auth	High8.8	—	0.9%	Jan 29, 2025
35Monitor	CVE-2025-24964No exploit	Remote Code Execution when accessing a malicious website while Vitest API server is listeningvitest.dev · vitest · CWE-1385 pre-auth RCE	High8.8	—	0.6%	Feb 4, 2025
35Monitor	CVE-2023-49805No exploit	Uptime Kuma Missing Origin Validation in WebSocketsdockge.kuma · dockge · CWE-1385	High8.8	—	0.3%	Dec 11, 2023
35Monitor	CVE-2023-2848No exploit	Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability.movim · movim · CWE-1385 Pre-auth	High8.8	—	0.3%	Sep 14, 2023
35Monitor	CVE-2025-52882No exploit	Claude Code IDE extensions allow websocket connections from arbitrary originsanthropics · claude-code · CWE-1385 Pre-auth	High8.8	—	0.3%	Jun 24, 2025
34Monitor	CVE-2026-85267No exploit	Cross-Site WebSocket Hijacking in Google Cloud Shellgoogle cloud · cloud shell · CWE-1385 Pre-auth	High8.7	—	0.2%	Oct 20, 2026
30Monitor	CVE-2026-57111No exploit	Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Originapache · helix · CWE-1385 Pre-auth	High7.5	—	0.3%	Jul 9, 2026
29Monitor	CVE-2025-54289No exploit	Privilege Escalation via WebSocket Connection Hijacking in LXD Operations APIcanonical · lxd · CWE-1385 RCE	High7.4	—	0.2%	Oct 2, 2025
27Monitor	CVE-2026-15580No exploit	PassPortal browser extension: vault token disclosure via unvalidated postMessagen-able · passportal · CWE-1385 Pre-auth	Medium6.9	—	0.2%	Aug 21, 2026
27Monitor	CVE-2025-61987No exploit	GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.groupsession · groupsession · CWE-1385 Pre-auth	Medium6.9	—	0.1%	Dec 12, 2025
26Monitor	CVE-2025-68930Proof of concept	Traccar Missing Origin Validation in WebSocketstraccar · traccar · CWE-1385 Pre-auth	Medium6.5	—	0.5%	Feb 23, 2026
26Monitor	CVE-2026-22689No exploit	Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emailsaxllent · mailpit · CWE-1385 Pre-auth Auth bypass	Medium6.5	—	0.2%	Jan 10, 2026
26Monitor	CVE-2025-56647No exploit	npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket.CWE-1385 Pre-auth	Medium6.5	—	0.2%	Feb 12, 2026
26Monitor	CVE-2026-44514No exploit	Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated userskubetail-org · kubetail · CWE-1385 Pre-auth	Medium6.5	—	0.1%	May 14, 2026
25Monitor	CVE-2025-36116No exploit	IBM Db2 Mirror for i cross-site websocket hijackingibm · db2 mirror for i · CWE-1385	Medium6.3	—	0.1%	Jul 23, 2025
23Monitor	CVE-2023-32264No exploit	CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2.opentext · documentum d2 · CWE-1385 RCE	Medium5.8	—	0.1%	Mar 8, 2024
22Monitor	CVE-2026-34403No exploit	Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpointsnginxui · nginx ui · CWE-1385 Pre-auth	Medium5.5	—	0.1%	Apr 20, 2026
21Monitor	CVE-2024-51775No exploit	Apache Zeppelin: Command Injection via CSWSHapache · zeppelin · CWE-1385 pre-auth RCE Command injection	Medium5.3	—	0.2%	Aug 3, 2025
21Monitor	CVE-2026-109330No exploit	Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServerjovancoding · network-ai · CWE-1385 Pre-auth	Medium5.3	—	0.1%	Oct 12, 2026

CVE-2014-125071
39Monitor
lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
gribbit project · gribbitJan 9, 2023
CVE-2024-23168
39Monitor
Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting i
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Aug 15, 2024
CVE-2023-0957
38Monitor
An issue was discovered in Gitpod versions prior to release-2022.11.2.16.
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
gitpod · gitpodMar 3, 2023
CVE-2023-26114
37Monitor
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
coder · code-serverMar 23, 2023
CVE-2026-85183
37Monitor
Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- CSRF
avaiga · taipySep 3, 2026
CVE-2026-35589
37Monitor
nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
nanobot · nanobotApr 14, 2026
CVE-2024-48849
35Monitor
Authentication and Authorization Issues
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
abb · flxeonJan 29, 2025
CVE-2025-24964
35Monitor
Remote Code Execution when accessing a malicious website while Vitest API server is listening
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
vitest.dev · vitestFeb 4, 2025
CVE-2023-49805
35Monitor
Uptime Kuma Missing Origin Validation in WebSockets
HighCVSS 8.8No exploitEPSS 0%
dockge.kuma · dockgeDec 11, 2023
CVE-2023-2848
35Monitor
Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
movim · movimSep 14, 2023
CVE-2025-52882
35Monitor
Claude Code IDE extensions allow websocket connections from arbitrary origins
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
anthropics · claude-codeJun 24, 2025
CVE-2026-85267
34Monitor
Cross-Site WebSocket Hijacking in Google Cloud Shell
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
google cloud · cloud shellOct 20, 2026
CVE-2026-57111
30Monitor
Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache · helixJul 9, 2026
CVE-2025-54289
29Monitor
Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
HighCVSS 7.4No exploitEPSS 0%
- RCE
canonical · lxdOct 2, 2025
CVE-2026-15580
27Monitor
PassPortal browser extension: vault token disclosure via unvalidated postMessage
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
n-able · passportalAug 21, 2026
CVE-2025-61987
27Monitor
GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2.
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
groupsession · groupsessionDec 12, 2025
CVE-2025-68930
26Monitor
Traccar Missing Origin Validation in WebSockets
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
traccar · traccarFeb 23, 2026
CVE-2026-22689
26Monitor
Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
axllent · mailpitJan 10, 2026
CVE-2025-56647
26Monitor
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket.
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
Feb 12, 2026
CVE-2026-44514
26Monitor
Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
kubetail-org · kubetailMay 14, 2026
CVE-2025-36116
25Monitor
IBM Db2 Mirror for i cross-site websocket hijacking
MediumCVSS 6.3No exploitEPSS 0%
ibm · db2 mirror for iJul 23, 2025
CVE-2023-32264
23Monitor
CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2.
MediumCVSS 5.8No exploitEPSS 0%
- RCE
opentext · documentum d2Mar 8, 2024
CVE-2026-34403
22Monitor
Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints
MediumCVSS 5.5No exploitEPSS 0%
- Pre-auth
nginxui · nginx uiApr 20, 2026
CVE-2024-51775
21Monitor
Apache Zeppelin: Command Injection via CSWSH
MediumCVSS 5.3No exploitEPSS 0%
- pre-auth RCE
- Command injection
apache · zeppelinAug 3, 2025
CVE-2026-109330
21Monitor
Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
jovancoding · network-aiOct 12, 2026

All vulnerability classes