WHartTest CVE-2026-111617

Exploitation requires that a WHartTest (through 2.8.1) instance expose its Django Channels WebSocket endpoints /ws/ui/web/ and /ws/ui/actuator/ to the attacker's network, and that a victim be actively running UI-automation test sessions to intercept and spoof. The flaw works against default configurations because UiAutomationConsumer performs no authentication and accepts every connection, so no special feature toggle is needed. The practical limits are network reachability of the WebSocket endpoints (an instance bound to localhost or behind an authenticating reverse proxy is not directly exploitable) and the presence of concurrent victim test traffic worth intercepting or spoofing; impact is confined to test-session confidentiality and integrity, with no availability effect.

This is a genuine but moderate-severity issue, not a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which maps to the CWE-306 missing-authentication root cause and the description's claim that UiAutomationConsumer accepts every WebSocket connection - these signals are internally consistent. However, impact is explicitly bounded: VC:L/VI:L and VA:N mean limited confidentiality and integrity loss with no availability impact, yielding a 6.9 (Medium) score rather than Critical. No EPSS probability was provided, the CVE is not listed in CISA KEV, and no POC flag was set in the input (the referenced hackmd write-up is a technical analysis rather than a confirmed weaponized exploit). The dominant risk-limiting factor is deployment footprint: WHartTest is an obscure open-source Django-based UI-automation testing tool, so despite the easy unauthenticated vector, real-world exploitation opportunity is narrow and likely opportunistic/targeted rather than widespread. Priority should be driven by whether an organization actually runs WHartTest with exposed WebSocket endpoints, not by the raw vector alone.

An attacker with network access to a WHartTest 2.8.1 instance opens a WebSocket to /ws/ui/web/ or /ws/ui/actuator/ without any credentials, since the consumer accepts all connections. By registering an actuator with a client-supplied id, they intercept other users' test-case payloads and broadcast step results, then inject spoofed results and screen frames into a victim's active session. No public weaponized exploit is confirmed in the input, though a detailed technical write-up referencing the vulnerable code paths exists.