CVE-2026-50571

Received Received - Intake

Stored XSS in WebSub Verification Response

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demonstration site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-50571

Affected Vendors & Products

Vendor	Product	Version / Range
w3c	websub	= REC-websub-20180123

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects WebSub, a W3C protocol for content distribution. It involves a subscriber not properly validating the media type of the hub.challenge response. Attackers can exploit this by redirecting victims to crafted verification requests containing HTML or JavaScript, executing reflected content in the subscriber's origin. This allows reading private data or performing actions using the victim's session.

Detection Guidance

Detecting this vulnerability requires checking if your WebSub subscriber implementation echoes the hub.challenge value with unsafe media types like text/html or application/octet-stream without proper MIME sniffing protection. Inspect HTTP responses for verification requests to ensure they use safe media types and include X-Content-Type-Options: nosniff header.

Impact Analysis

If you use a vulnerable WebSub subscriber, an attacker could trick you into visiting a malicious link. This could lead to session hijacking, data theft, or unauthorized actions on your behalf. Attackers might access your localStorage, sessionStorage, or browser permissions tied to the subscriber's origin.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's privacy rules. If exploited, it may result in data breaches, requiring notifications and potential fines under these regulations.

Mitigation Strategies

Immediately update your WebSub subscriber implementation to echo the hub.challenge value with safe media types like text/plain. Ensure responses include the X-Content-Type-Options: nosniff header to disable MIME sniffing. Validate all callback URLs and restrict subscription origins to trusted domains.

Hi! I’m here to help you understand CVE-2026-50571. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70