WebSocket Authentication Bypass in Axis Device

Executive Summary

CVE-2026-63288 is a high-severity vulnerability where a WebSocket request sent to a specific API endpoint bypasses authentication, allowing unauthorized access to a separate API endpoint. This flaw is classified under CWE-306 (Missing Authentication for Critical Function).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor WebSocket traffic to API endpoints on affected AXIS devices. Check for unauthorized access attempts to endpoints that should require authentication. Use network traffic analysis tools like Wireshark to inspect WebSocket requests and responses for anomalies. Verify if requests to sensitive endpoints are being processed without proper authentication headers or tokens.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to gain unauthorized access to sensitive API endpoints, potentially exposing confidential data or enabling further attacks on affected devices. The high CVSS score of 8.3 indicates significant risk.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update all affected AXIS devices to Secure Entry version 12.11.106.1 or later. Disable or restrict access to WebSocket endpoints if updates cannot be applied immediately. Review network logs for suspicious activity related to API endpoint access. Contact Axis technical support for guidance on patching and mitigation strategies.

Useful 0 Not Useful 0