CVE-2026-66420

Received Received - Intake

Cross-Site WebSocket Hijacking in MeshCentral

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-66420

EUVD

EUVD-2026-51333

Affected Vendors & Products

Vendor	Product	Version / Range
meshcentral	meshcentral	1.1.21

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

MeshCentral 1.1.21 has a vulnerability where attackers can bypass WebSocket hijacking protections to hijack authenticated administrator sessions. This happens due to an unconditional early return in the CheckWebServerOriginName() function when self-signed certificates are used. Attackers can open cross-origin WebSocket connections to any of the twelve endpoints, send crafted commands to steal the server sessionKey, forge session tokens, and gain full remote control over all managed devices in the MeshCentral instance.

Detection Guidance

Detecting this vulnerability requires checking for unconditional early returns in the CheckWebServerOriginName() function within webserver.js of MeshCentral 1.1.21 when self-signed certificates are used. Inspect the function for improper origin validation logic. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to take full control of your MeshCentral server and all managed devices. They can steal sensitive data, install malware, or disrupt operations. Since it bypasses authentication, even non-technical users could be affected if their devices are managed by a vulnerable MeshCentral instance.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using MeshCentral 1.1.21 may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade MeshCentral to a version that patches the CheckWebServerOriginName() vulnerability. If using self-signed certificates, ensure proper origin validation is enforced. Restrict access to WebSocket endpoints and monitor for unauthorized session key exfiltration attempts.

Hi! I’m here to help you understand CVE-2026-66420. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70