CVE-2026-85183
Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 3, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 3, 2026
Description
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | VulnCheck |
| 3.1 | 9.3 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-1385 Missing Origin Validation in WebSockets
Affected Products
| Product | Versions |
|---|---|
taipyAvaiga |
|
References
- GitHub Issue #2890issue-tracking
- https://github.com/Avaiga/taipyproduct
- gui/server.py at 4.1.1technical-description
- VulnCheck Advisory: Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORSthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.