CVE-2025-54816
Severity CVSS v4.0:
Pending analysis
Type:
CWE-306
Missing Authentication for Critical Function
Publication date:
22/01/2026
Last modified:
22/01/2026
Description
This vulnerability occurs when a WebSocket endpoint does not enforce <br />
proper authentication mechanisms, allowing unauthorized users to <br />
establish connections. As a result, attackers can exploit this weakness <br />
to gain unauthorized access to sensitive data or perform unauthorized <br />
actions. Given that no authentication is required, this can lead to <br />
privilege escalation and potentially compromise the security of the <br />
entire system.
Impact
Base Score 3.x
9.40
Severity 3.x
CRITICAL