EUVD-2026-76105Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable cross-origin WebSocket attack; no attacker credentials needed; victim browser access required (UI:R); API key abuse enables full confidentiality, integrity, and availability impact on the LLM account.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the OPENAI_API_KEY environment variable. Version 0.35.0 fixes the issue.
AnalysisAI
Cross-origin WebSocket hijacking in Headroom's proxy layer (prior to v0.35.0) allows an unauthenticated attacker-controlled webpage to issue arbitrary LLM requests through the victim's Headroom instance without authentication. Because the WebSocket server forwards requests to the upstream LLM provider without validating the Origin header, any browser with network access to the proxy-standard or headless-can be weaponized as a relay. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must be met simultaneously: (1) the Headroom WebSocket proxy is reachable from the victim's browser-either because it is bound to localhost in a developer's environment, hosted on an intranet, or (worst case) exposed to the internet; (2) the OPENAI_API_KEY environment variable is configured in the Headroom process; and (3) the victim loads a malicious or compromised webpage in a browser that has network access to the proxy endpoint, or a headless browser such as lightpanda is used in an automated pipeline. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the attack profile: network-reachable, low complexity, no attacker credentials required, but gated on the victim's browser having network access to the proxy endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Headroom to version 0.35.0 or later, which introduces Origin header validation on the WebSocket server. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Headroom deployments by version and restrict network access to the proxy to trusted internal sources only via firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-user memory disclosure and tampering in Headroom's LLM proxy (versions before 0.36.1) lets a caller read or overwr
Server-side request forgery in Headroom LLM proxy (versions before 0.36.1) allows unauthenticated remote attackers to re
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today