CWE-1385 Missing Origin Validation in WebSockets
variantThe product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (53)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-30856US | critical10.0 | — | ||
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious we… | ||||
| CVE-2014-125071US | critical9.8 | — | ||
A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageReceived of the file src/gribbit/request/HttpRequestHandler.j… | ||||
| CVE-2026-27148US | critical9.6 | — | ||
Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality i… | ||||
| CVE-2023-0957US | critical9.6 | — | ||
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket co… | ||||
| CVE-2026-85183US | critical9.3 | — | ||
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applica… | ||||
| CVE-2026-35589US | critical9.3 | — | ||
nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server in bridge/src/ser… | ||||
| CVE-2023-26114US | critical9.3 | — | ||
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in spec… | ||||
| CVE-2025-68930US | medium6.5 | Exploit | ||
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The… | ||||
| CVE-2025-24964US | high8.8 | — | ||
Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listen… | ||||
| CVE-2023-49805US | high8.8 | — | ||
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of commu… | ||||
| CVE-2023-2848US | high8.8 | — | ||
Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation. | ||||
| CVE-2026-67405US | high8.1 | — | ||
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_… | ||||
| CVE-2026-59950US | high8.1 | — | ||
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transp… | ||||
| CVE-2026-34403US | high8.1 | — | ||
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin uncondition… | ||||
| CVE-2025-54289US | high8.1 | — | ||
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrar… | ||||
| CVE-2023-23602US | medium6.5 | — | ||
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restrict… | ||||
| CVE-2026-1692US | medium6.1 | — | ||
A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 1… | ||||
| CVE-2026-27977US | medium5.4 | — | ||
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal web… | ||||
| CVE-2026-21883US | medium5.4 | — | ||
Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can re… | ||||
| CVE-2024-51775US | medium5.3 | — | ||
Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.
The attacker could access the Zeppelin server from another origin without any restriction, and get intern… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan