EUVD-2026-70487
GHSA-jcr8-jmf2-43vw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no credentials (PR:N) but requires victim with active session to visit attacker page (UI:R); attacker can read state and drive callbacks (C:H/I:H), no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.
AnalysisAI
Cross-Site WebSocket Hijacking in Avaiga Taipy through version 4.1.1 lets any attacker-controlled web page open credentialed socket.io/WebSocket sessions to a victim's running Taipy application and drive it remotely. Because the socket.io server is configured with a wildcard CORS origin while also enabling the credentials flag, the browser attaches the victim's session and no CSRF token gates the channel, so a malicious site can silently modify GUI state variables and fire action callbacks on the victim's behalf. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Taipy socket.io server to be running with its default/vulnerable configuration of wildcard CORS origin ('*') plus the credentials flag enabled (the shipped configuration through 4.1.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N) rates this critical, but the score hinges on UI:P - the attack is not fully autonomous: a victim who has an active/authenticated Taipy session must visit an attacker-controlled page for the hijack to succeed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the provided data - upstream tracking exists at GitHub issue #2890 but no tagged fixed release is confirmed, so treat this as 'no vendor-released patch identified at time of analysis' and monitor the Avaiga/taipy repository and VulnCheck advisory for a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately inventory all Avaiga Taipy deployments running versions 4.1.1 or earlier and assess network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-1385 – Missing Origin Validation in WebSockets
View allShare
External POC / Exploit Code
Leaving vuln.today