CWE-1385 Missing Origin Validation in WebSockets
Description
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1385 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-h46j-26q3-rggf | CVE-2026-71416 | HIGH |
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH) |
2026-10-02 | |
| GHSA-vj7q-gjh5-988w | CVE-2026-59950 | HIGH |
MCP Python SDK: WebSocket server transport does not support Host/Origin validation |
2026-07-16 | |
| GHSA-5c57-rqjx-35g2 | CVE-2026-44211 | CRITICAL |
Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability |
2026-06-09 | |
| GHSA-v8j7-hp7c-738f | CVE-2026-44514 | MODERATE |
Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users |
2026-05-14 | |
| GHSA-78mf-482w-62qj | CVE-2026-34403 | HIGH |
Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints |
2026-04-27 | |
| GHSA-jcc7-9wpm-mj36 | CVE-2026-27977 | LOW |
Next.js: null origin can bypass dev HMR websocket CSRF checks |
2026-03-25 | |
| GHSA-mjf5-7g4m-gx5w | CVE-2026-27148 | HIGH |
Storybook Dev Server is Vulnerable to WebSocket Hijacking |
2026-02-26 | |
| GHSA-p773-8mf4-rjm5 | CVE-2025-56647 | MODERATE |
@farmfe/core is Missing Origin Validation in WebSocket |
2026-02-12 | |
| GHSA-793v-589g-574v | CVE-2026-21883 | MODERATE |
Bokeh server applications have Incomplete Origin Validation in WebSockets |
2026-01-23 | |
| GHSA-524m-q5m7-79mm | CVE-2026-22689 | MODERATE |
Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails |
2026-01-13 | |
| GHSA-3g72-chj4-2228 | CVE-2025-54289 | HIGH |
Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API |
2025-11-05 | |
| GHSA-xg8j-j6vp-6h5w | CVE-2024-51775 | MODERATE |
Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability |
2025-11-05 | |
| GHSA-q355-h244-969h | - | HIGH |
Komari vulnerable to Cross-site WebSocket Hijacking |
2025-08-12 | |
| GHSA-9f65-56v6-gxw7 | CVE-2025-52882 | HIGH |
Claude Code Improper Authorization via websocket connections from arbitrary origins |
2025-06-27 | |
| GHSA-3h52-269p-cp9r | CVE-2025-48068 | LOW |
Information exposure in Next.js dev server due to lack of origin verification |
2025-06-13 | |
| GHSA-vg6x-rcgg-rjx6 | CVE-2025-24010 | MODERATE |
Websites were able to send any requests to the development server and read the response in vite |
2025-02-07 | |
| GHSA-9crc-q9x8-hgqq | CVE-2025-24964 | CRITICAL |
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening |
2025-02-04 | |
| GHSA-4qcv-qf38-5j3j | CVE-2023-2850 | MODERATE |
Unintentional leakage of private information via cross-origin websocket session hijacking |
2023-07-25 | |
| GHSA-frjg-g767-7363 | CVE-2023-26114 | CRITICAL |
code-server vulnerable to Missing Origin Validation in WebSockets |
2023-03-27 |