Midscene Bridge Server CVE-2026-59804

Exploitation requires that the Midscene Bridge Server be running with an active bridge session, and that the victim visit an attacker-controlled web page in a browser that can reach the local Socket.IO port (UI:P - victim interaction is required). No authentication token is needed and no Origin validation is performed, so any origin can connect; the attacker races to seize the single-client slot. Limiting factors: the server must be actively running (not a persistent daemon in typical use), the victim must load attacker JavaScript, and high attack complexity (AC:H) reflects the timing/session-state dependency - this is a developer-workstation-local service, not an internet-exposed one, so the network vector is realized through the victim's own browser rather than direct remote reach.

The vendor CVSS 4.0 score is 7.6 (High) with vector AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N, indicating network reachability with no privileges but with meaningful mitigating factors: high attack complexity (AC:H) and required user interaction (UI:P - the victim must visit an attacker-controlled page while a bridge session is active). Publicly available exploit code exists and the flaw was reported by VulnCheck, raising practical exploitability, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of widespread or active exploitation - this suggests a real but opportunistic/targeted risk rather than mass exploitation. Note a discrepancy worth flagging: the description states the server can be 'unconditionally terminated,' a clear availability impact, yet the vendor 4.0 vector sets VA:N (no availability impact) - my independent assessment treats the kill capability as an availability impact. No SSVC decision data was provided. Overall this is a genuine developer-workstation threat but its footprint is limited by the niche product and the need for an active session plus victim interaction.

A developer runs a Midscene automation task with the Bridge Server active on their workstation, then visits an attacker-controlled or compromised web page in the same browser. Malicious JavaScript on that page opens a cross-origin WebSocket to the local Socket.IO server, hijacks the single-client slot, and injects automation commands or exfiltrates command payloads - or appends MIDSCENE_BRIDGE_SIGNAL_KILL to terminate the server. Publicly available exploit code demonstrates the session hijack.