Skip to content
OpenAdvisories

Vendor

mockoon

3 known vulnerabilities.

Products

mockoon 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-59148

    Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

    Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Con…

    mockoon mockoon @mockoon/cli @mockoon/commons-server npm
  • High 7.5
    CVE-2025-59049

    Mockoon has a Path Traversal and LFI in the static file serving endpoint

    Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user …

    mockoon mockoon @mockoon/cli @mockoon/commons-server npm