tag
Websocket
WebSocket Authentication Brute-Force via Missing Rate Limiting (CVE-2026-27778)
This repository is a hands-on simulator for CVE-2026-27778 (CWE-307: Improper Restriction of Excessive Authentication Attempts) built around a small Node.js/Express server that accepts WebSocket AUTHREQ messages containing a password guess and replies with…
Red Hat Cockpit `logsJournal.jsx` Shell Injection RCE (CVE-2026-4802)
Cockpit's systemd logs page builds a journalctl invocation from URL-fragment-derived filter parameters (such as --since=) inside loadServiceFilters(). The resulting argument array is joined into a single shell string with only whitespace escaping and then…
OpenClaw Gateway WebSocket Authentication Bypass RCE — CVE-2026-28466
OpenClaw exposes a WebSocket control-plane gateway (/ws) used to manage connected nodes/agents. The gateway's connect handshake accepts a client-supplied auth token and role/scope set without properly validating that the presented token is bound to the…
GitLab WebSocket GraphqlChannel Unauthorized Method Enumeration — CVE-2026-5173
CVE-2026-5173 allows a low-privileged authenticated GitLab user to invoke backend GraphQL methods over the /-/cable ActionCable WebSocket endpoint via the GraphqlChannel, methods that should otherwise be gated by normal GraphQL authorization checks. The PoC…
Next.js WebSocket Upgrade SSRF (Self-Hosted) (CVE-2026-44578)
CVE-2026-44578 is a server-side request forgery (SSRF) vulnerability in self-hosted Next.js WebSocket upgrade handling. A crafted HTTP request with Upgrade: websocket can coerce vulnerable versions into proxying to attacker-chosen internal targets on port 80…
Fortinet FortiOS / FortiProxy Authentication Bypass (CVE-2024-55591)
CVE-2024-55591 is an authentication bypass in Fortinet management interfaces that can be abused over a crafted WebSocket workflow. The public PoC demonstrates racing WebSocket login-context traffic to gain effective super-admin CLI access without valid…