CVE-2026-59804

{"id": "CVE-2026-59804", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59804", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T14:02:32.806757Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/web-infra-dev/midscene", "vendor": "web-infra-dev", "product": "midscene", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.10.3"}, {"status": "unaffected", "version": "86f4118d1d847041c63d79e347e08c87c3f1a882", "versionType": "git"}], "packageURL": "pkg:npm/%40midscene/web", "defaultStatus": "unaffected"}]}], "published": "2026-07-08T20:16:56.077", "references": [{"url": "https://github.com/web-infra-dev/midscene/commit/86f4118d1d847041c63d79e347e08c87c3f1a882", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/web-infra-dev/midscene/issues/2752", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/web-infra-dev/midscene/pull/2759", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/midscene-bridge-server-session-hijack-via-unauthenticated-websocket", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-1385"}]}], "descriptions": [{"lang": "en", "value": "Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-origin WebSocket connection to the local Socket.IO server, which performs no Origin header validation and requires no authentication token. Attackers can connect from any web page visited by the victim to seize the single-client slot, intercept and inject automation commands, exfiltrate command-payload data, or unconditionally terminate the server by supplying the MIDSCENE_BRIDGE_SIGNAL_KILL query parameter."}, {"lang": "es", "value": "Midscene Bridge Server hasta la versi\u00f3n 1.10.3, corregido en el commit 86f4118, contiene una vulnerabilidad de falta de autenticaci\u00f3n y mala configuraci\u00f3n de CORS que permite a atacantes remotos no autenticados secuestrar sesiones de puente activas abriendo una conexi\u00f3n WebSocket de origen cruzado al servidor Socket.IO local, que no realiza validaci\u00f3n del encabezado Origin y no requiere ning\u00fan token de autenticaci\u00f3n. Los atacantes pueden conectarse desde cualquier p\u00e1gina web visitada por la v\u00edctima para apoderarse del slot de un solo cliente, interceptar e inyectar comandos de automatizaci\u00f3n, exfiltrar datos de carga \u00fatil de comandos o terminar incondicionalmente el servidor suministrando el par\u00e1metro de consulta MIDSCENE_BRIDGE_SIGNAL_KILL."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "disclosure@vulncheck.com"}