CVE-2026-85183: Missing Origin Validation in WebSockets in Avaiga taipy

The vulnerability in Avaiga taipy's socket.io server configuration involves missing origin validation combined with wildcard CORS origin and enabled credential flags. This misconfiguration permits attackers to initiate credentialed WebSocket connections from any domain, bypassing CSRF protections. Consequently, attackers can manipulate state variables and trigger action callbacks remotely without proper authorization checks. The affected versions are from 0 up to and including 4.1.1. The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

An attacker can establish credentialed WebSocket connections from arbitrary domains to victim applications running vulnerable versions of Avaiga taipy. This allows unauthorized modification of state variables and invocation of action callbacks without CSRF protection, potentially leading to unauthorized actions and compromise of application state and data confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid deploying vulnerable versions or restrict WebSocket origins and disable wildcard CORS origins with credentials enabled to prevent unauthorized cross-origin WebSocket connections.