Missing Origin Validation in WebSockets
CWE-1385
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
We track 23 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Implementation: Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.
- Implementation: Use a randomized CSRF token to verify requests.
- Implementation: Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.
- Architecture and Design Implementation: Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.
- Implementation: Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.
Latest Missing Origin Validation in WebSockets vulnerabilities
- 8.1 High severity
universal-modder: Missing Origin Validation in WebSockets
Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page
- 7.2 High severity
Agent Development Kit (ADK) for Java: Missing Authentication for Critical Functionality
Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1
- 8.2 High severity
webpack-dev-server: Origin Validation Error
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the p
- 8.7 High severity
Cloud Shell: Missing Origin Validation in WebSockets
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket re
- 8.8 High severity
obsidian-tc: Origin Validation Error
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration u
- 8.1 High severity
rabbitmq-server: Missing Origin Validation in WebSockets
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_w
- 8.8 High severity
headroom: Improper Authentication
Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, al
- 9.3 Critical severity
taipy: Missing Origin Validation in WebSockets
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke s
- 8.1 High severity
python-sdk: Origin Validation Error
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validat
- 7.5 High severity
Apache Helix REST: Missing Origin Validation in WebSockets
Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on all platforms allows a remote attacker controlling a web page visited by an authorized user to read r
- 8.8 High severity
Eclipse Theia: Missing Authentication for Critical Functionality
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is
- 9.6 Critical severity
cline: Missing Authentication for Critical Functionality
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.
- 8.1 High severity
nginx-ui: Missing Origin Validation in WebSockets
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined w
- 9.3 Critical severity
nanobot: Missing Origin Validation in WebSockets
nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server in bridge/src/server.ts, resulting from an incomplete remediation of CVE-2026-2577. The original
- 8.1 High severity
LXD: Missing Origin Validation in WebSockets
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
- 8.8 High severity
claude-code: Missing Origin Validation in WebSockets
Claude Code is an agentic coding tool. Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Pycharm, and Android Studio) are vulnerable to unauthorized websocket connections from an attacker when
- 8.8 High severity
vitest: Missing Origin Validation in WebSockets
Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enab
- 9.4 Critical severity
FLXEON: Missing Origin Validation in WebSockets
Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through <= 9.3.4.
- 9.8 Critical severity
xsoverlay: Missing Origin Validation in WebSockets
Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.
- 8.8 High severity
uptime-kuma: Origin Validation Error
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of communication is valid. This allows third-party website to access the application on
- 10.0 Critical severity
edex-ui: Origin Validation Error
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitr
- 9.3 Critical severity
code-server: Origin Validation Error
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.
- 9.6 Critical severity
Gitpod: Origin Validation Error
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the