Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1385: Missing Origin Validation in WebSockets

Variant Incomplete

The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

How to prevent it (7 mitigations)

  1. Implementation

    Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.

  2. Implementation

    Use a randomized CSRF token to verify requests.

  3. Implementation

    Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.

  4. Architecture and Design, Implementation

    Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.

  5. Implementation

    Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.

  6. Implementation

    Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set.

  7. Implementation

    Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc.

Source: MITRE CWE-1385

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-85183

    Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

    Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke …

    Avaiga taipy
  • Critical 9.6
    CVE-2026-44211

    Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

    Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

    cline cline cline npm
  • Critical 9.7
    CVE-2025-24964

    Remote Code Execution when accessing a malicious website while Vitest API server is listening

    Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is ena…

    vitest-dev vitest vitest npm
  • Critical 9.4
    CVE-2024-48849 Public exploit

    Authentication and Authorization Issues

    Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through <= 9.3.4.

    ABB FLXEON ICS / OT
  • Critical 9.8
    CVE-2024-23168

    Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSo…