EUVD-2026-15002
GHSA-mr94-p7f2-xw23
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.
AnalysisAI
HCL Traveler contains a weak default HTTP header validation vulnerability (CWE-346) that allows authenticated attackers to bypass additional authentication checks and gain unauthorized access to sensitive functionality. The vulnerability affects HCL Traveler across multiple versions and requires only network access and valid credentials to exploit. While the CVSS score is moderate (6.3) and no active exploitation in the wild has been documented in KEV databases, the authentication bypass nature of this issue presents a real risk to organizations relying on Traveler for secure communications.
Technical ContextAI
This vulnerability is rooted in CWE-346 (Origin Validation Error), a class of weakness where applications fail to properly validate the origin or source of HTTP requests through header inspection. HCL Traveler, identified via CPE (cpe:2.3:a:hclsoftware:traveler:*:*:*:*:*:*:*:*), implements HTTP header-based security controls that are insufficient in their default configuration. Specifically, the application does not adequately validate headers such as Origin, Referer, or custom authentication headers, allowing an attacker with valid credentials to craft malicious requests that bypass secondary authentication mechanisms. This is a common pattern in enterprise collaboration software where additional authentication layers are expected to prevent lateral movement or privilege escalation.
RemediationAI
Organizations must upgrade HCL Traveler to the patched version specified in HCL's security advisory KB0129139 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129139). Until patches can be applied, implement compensating controls by enforcing strict HTTP header validation at the reverse proxy or WAF layer, explicitly rejecting requests with malformed or unexpected origin headers, and implementing HSTS (HTTP Strict-Transport-Security) to prevent header stripping attacks. Additionally, restrict Traveler access to trusted network segments, enforce multi-factor authentication independent of the HTTP header validation, and monitor authentication logs for anomalous authentication patterns or requests from unexpected origins.
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via t
A critical PHP object injection vulnerability exists in the Shinetheme Traveler WordPress theme due to insecure deserial
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release throug
IBM Traveler 8.x and 9.x before 9.0.1.12 allows remote authenticated users to read arbitrary files or cause a denial of
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. Rated medium severity (CVSS 5.4),
There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf). Rated medium
HCL Traveler contains a sensitive information disclosure vulnerability where error messages expose internal system detai
HCL Traveler's Apple profile generation page reflects user-submitted Logon Name and Mail Address values into generated A
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal
HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reve
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today