WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 6.9NVD modified 2026-10-16 20:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/ui_automation/consumers.py#L129-L186
- https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/wharttest_django/asgi.py#L41-L53
- https://hackmd.io/@hieuPenguinnn/wharttest-ui-automation-websocket-missing-authentication
- https://www.vulncheck.com/advisories/wharttest-through-2.8.1-missing-authentication-on-ui-automation-websocket-endpoints
- https://hackmd.io/@hieuPenguinnn/wharttest-ui-automation-websocket-missing-authentication