Cross-Site WebSocket Hijacking in Taipy by Avaiga

CVE-2026-85183

What is CVE-2026-85183?

Taipy's configuration of its socket.io server with wildcard CORS origins and the credential flag enabled poses a significant security risk. This vulnerability allows attackers to establish unauthorized WebSocket connections from arbitrary domains. Once an attacker exploits this issue, they can manipulate state variables and execute action callbacks without proper CSRF protection, leading to potential system compromises. It is crucial for developers and system administrators using Taipy to implement appropriate security measures to safeguard their applications against this threat.

References