CVE-2026-66420 describes a cross-site WebSocket hijacking protection bypass in MeshCentral 1.1.21. The vulnerability arises from an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. This allows unauthenticated remote attackers to open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted commands to exfiltrate the server sessionKey used for signing session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

An attacker can hijack authenticated administrator sessions without prior authentication, enabling them to fully control all devices managed by the vulnerable MeshCentral server. This compromises confidentiality, integrity, and availability of the managed infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using self-signed certificates with MeshCentral 1.1.21 or restrict access to trusted networks to reduce exposure.