CVE-2024-10956
Cross-Site WebSocket Hijacking in binary-husky/gpt_academic
- State
- Published
- Severity
- 7.6 High
- Published
- Mar 20, 2025
- Updated
- Jul 15, 2025
- Reserved
- Nov 6, 2024
Description
GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting conversation history without the victim's consent. The issue arises due to insufficient WebSocket authentication and lack of origin validation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.6 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L | @huntr_ai |
Weaknesses
- CWE-346 Origin Validation Error
Affected Products
| Product | Versions |
|---|---|
binary-husky/gpt_academicbinary-husky |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.