CVE-2025-54816
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
2Description
This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
Analysis
A WebSocket endpoint lacks proper authentication, allowing unauthenticated users to connect and interact with real-time data streams and server-side functionality.
Technical Context
The WebSocket endpoint does not enforce authentication (CWE-306), allowing any client to establish a WebSocket connection and interact with the server's real-time functionality without credentials.
Affected Products
['Affected product (per NVD)']
Remediation
Implement WebSocket authentication (token-based or session-based). Validate credentials on connection establishment.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today