CVE-2026-111617
Received Received - Intake

Unauthenticated WebSocket Access in WHartTest

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111617
EUVD
EUVD-2026-103039

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MGdaasLab WHartTest 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WHartTest through version 2.8.1 has a missing authentication vulnerability in its WebSocket endpoints (/ws/ui/web/ and /ws/ui/actuator/). The UiAutomationConsumer accepts all connections without verification, allowing unauthenticated attackers to register actuators with arbitrary IDs. This enables interception of other users' test-case payloads, reception of broadcast step results, and spoofing of results or screen frames into victim sessions.

Detection Guidance

Check for unauthenticated WebSocket connections to /ws/ui/web/ and /ws/ui/actuator/ endpoints. Use tools like curl or netcat to probe these paths. Monitor network traffic for unexpected WebSocket handshakes or data exchanges on these endpoints.

Impact Analysis

An attacker could intercept your test-case payloads, including sensitive data like step definitions, URLs, and file references. They can receive your broadcast step results and inject forged results or screen frames into your sessions. This could lead to data leakage, unauthorized control over test automation, or manipulation of test outcomes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized disclosure, or integrity issues, potentially leading to non-compliance with these regulations.

Mitigation Strategies

Immediately upgrade WHartTest to a patched version if available. If not, restrict access to the vulnerable WebSocket endpoints via firewall rules or network segmentation. Implement authentication middleware for WebSocket connections as described in the advisory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111617. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart