Vulnerabilities

Security incident · GHSA-mww8-4gwh-rjfw

Missing Origin validation on WebSocket upgrades allows Cross-Site WebSocket Hijacking

Published Aug 5, 2026 · catalog updated Aug 5, 2026 · Missing Origin validation on

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-mww8-4gwh-rjfw. A missing EPSS score is not a low risk. Compare Missing Origin validation on with the linked advisory before you change production.

Severity

High8.1

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

npm directus

# Missing Origin validation on WebSocket upgrades allows Cross-Site WebSocket Hijacking ## Summary The WebSocket upgrade handler accepted cross-origin upgrade requests that carried the session cookie, without validating the header of the handshake. A browser automatically attaches cookies to a WebSocket handshake and, unlike the REST and GraphQL transports, the upgrade path is registered directly on the HTTP server and therefore never passes through the CORS middleware. In affected deployments, a page on an attacker-controlled origin could open a WebSocket to a Directus instance and have the connection authenticated as the visiting user. ## Details When a WebSocket upgrade request arrived with a session cookie present, the connection was authenticated from that cookie and the socket was established with the corresponding user's accountability. No comparison was made against the request host, , or the allowlist before accepting the upgrade. The cookie branch was evaluated ahead of the configured WebSocket authentication mode, so setting or to or did not prevent a cookie-bearing handshake from being accepted. Exploitation requires all of the following: - WebSockets are enabled ( ). This is not the default. - The victim is signed in using session cookie authentication, which is the mode the Admin App uses. - The victim's browser attaches the session cookie to the attacker's cross-origin handshake. This happens when is set to (a configuration used for cross-origin Admin App deployments), or when the attacker controls a site that is same-site with the API host, such as a sibling subdomain, in which case the default setting still sends the cookie. - The victim visits the attacker-controlled page while their session is valid. ## Impact An attacker who can get a signed-in user to load a page under their control can drive an authenticated WebSocket session with that user's permissions. Over that connection they can read, create, update, and delete items, and open subscriptio