Cross-site Web Socket hijacking
Summary: Cross-site WebSocket hijacking is a cross-site request forgery vulnerability on a WebSocket handshake, arising when the handshake relies solely on HTTP cookies for session handling and contains no CSRF tokens or other unpredictable values. An attacker's page on their own domain can open a cross-site WebSocket connection that the application handles in the victim user's session, letting the attacker send arbitrary messages and read the responses, giving two-way interaction rather than the one-way action of regular CSRF.
Bottom line: The attacker does not just trigger an action in the victim's session; they get a two-way channel into the application as that user, and the only precondition is a handshake that authenticates with cookies alone.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026