MajorCritical vulnerability

CVE-2026-63288 (CVSS 8.3)

NVD · officialPublished Nov 10, 2026Risk 37/100

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.

Technical details

CVSS

8.3

AV:Adjacent NetworkAC:LowPR:NoneUI:NoneC:HighI:HighA:Low

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source