CVE-2026-13125
Severity CVSS v4.0:
Pending analysis
Type:
CWE-306
Missing Authentication for Critical Function
Publication date:
02/07/2026
Last modified:
02/07/2026
Description
GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.<br />
<br />
In order to access the websocket server, no authentication is required. As such, any malicious website can attempt to open a connection to the server and potentially access sensitive APIs. In particular, it&#39;s possible to call a combination of the `create` method and `getScreenCapture` to retrieve the content of the user&#39;s screen.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH