CVE-2026-81315 is an origin validation error vulnerability in ash-project's ash_ai server component that allows a malicious web page to bypass DNS-rebinding protections. The vulnerability arises because the server trusts the Host header and X-Forwarded-Proto header without proper validation, enabling an attacker to issue cross-site requests to a user's local MCP server with that user's privileges. This affects ash_ai versions from 0.8.0 up to but not including 1.0.0. The default configuration is insecure, but the fix involves restricting trusted origins to localhost and requiring an explicit allowlist for others.
CVE-2026-70309 is an origin validation error vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to bypass a security feature over a network. The issue affects versions from 1.0.0.0 up to but not including 150.0.4078.65. Microsoft has released an official fix in version 150.0.4078.65 to address this vulnerability. The CVSS v3.1 base score is 5.4, indicating a medium severity level.
CVE-2026-59297 is a low severity vulnerability in Spring Cloud Function affecting versions 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. The issue arises because the isSecure() method in ServerlessHttpServletRequest does not properly verify the actual scheme, leading to an origin validation error classified as CWE-346. This could potentially allow incorrect assumptions about the security of a connection.
CVE-2026-55637 is an origin validation error in the Streamable HTTP transport of the genieacs-mcp server prior to version 0.3.2. The vulnerability arises because the /mcp listener on 127.0.0.1:8080 does not validate Host or Origin headers when MCP_AUTH_TOKEN is unset, allowing DNS rebinding attacks. Exploitation can lead to unauthorized initialization of MCP sessions and invocation of operations against the GenieACS NBI, potentially exposing or modifying CPE management state such as device reboots and firmware tasks. The issue is fixed in version 0.3.2.
CVE-2026-55532 is an origin validation vulnerability in MervinPraison PraisonAI prior to version 4.6.58. The issue arises because the HTTP stream origin validation uses a startswith check, allowing attacker-controlled origins like localhost.attacker.com to bypass the localhost allowlist. This enables a webpage to send text/plain requests without preflight and invoke certain API calls without an API key, including file writes that can persist agent instructions. The vulnerability is fixed in version 4.6.58.
CVE-2026-55529 is a vulnerability in MervinPraison's PraisonAI multi-agent teams system prior to version 4.6.58. The issue arises because the MCP HTTP Stream _validate_origin method incorrectly validates origins by using a startswith check, allowing attacker-controlled origins like localhost.evil.example to bypass the localhost allowlist. This enables a malicious webpage to submit requests to the local MCP server without an API key and execute exposed tools. The vulnerability is fixed in version 4.6.58.
FORT Validator versions up to 1.6.7 have an origin validation error in their RRDP processing that allows a delegated CA under the same Trust Anchor Locator to reference another CA's RRDP URLs. This can cause FORT Validator to delete the victim CA's local snapshot and silently remove validated route-origin data, potentially enabling route hijacking or loss of reachability. Version 1.6.8 includes a patch that rejects cross-origin RRDP snapshot and delta URLs. As a workaround, administrators can disable HTTP/RRDP while keeping rsync enabled, though this may cause data unavailability or staleness where rsync is unsupported.
CVE-2026-53656 is an origin validation error in the open-source FiftyOne platform prior to version 1.17.0. The FiftyOne App/API server unconditionally allowed cross-origin requests by setting Access-Control-Allow-Origin to '*'. This allowed malicious websites visited by users to read cross-origin responses. The /media endpoint accepts a filesystem path, enabling a drive-by page to read files accessible to the server process and exfiltrate them without user interaction. The issue is fixed in version 1.17.0 by introducing explicit cross-origin access controls.
Microsoft UFO versions prior to 3.0.8 contain a vulnerability where the FastMCP HTTP server bound to localhost:8010 does not validate Host, Origin, or Sec-Fetch-Site headers. This allows an attacker to use DNS rebinding to access the local /mcp endpoint, enumerate tool schemas, and invoke execute_command with a valid API key, potentially reading files or executing OS commands as the victim user. The issue is fixed in version 3.0.8.
CVE-2026-67448 is a vulnerability in axllent mailpit versions 1.29.0 through 1.30.5 involving improper handling of URL encoding in WebSocket origin checks. The origin check relies on the raw request URI prefix, but Go's ServeMux routes on the percent-decoded path, allowing an attacker to bypass origin validation by encoding the path. This leads to unauthorized WebSocket connections that can leak sensitive email data. The issue arises because the upgrader accepts all origins and the middleware origin check is bypassed due to inconsistent handling of encoded URLs.
The web
interface of the affected
device relies on the HTTP referrer header as part of
request validation. Requests containing empty Referer value, or omitting
the Referer header entirely, may be accepted and processed due to insufficient
validation logic.
Successful exploitation may allow an adjacent attacker with access to the web management
interface to obtain device configuration details and other sensitive
information.
NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw.
### Problem
The referrer enforcement introduced with [TYPO3-CORE-SA-2020-006](https://news.typo3.com/security/advisory/typo3-core-sa-2020-006) ([CVE-2020-11069](https://www.cve.org/CVERecord?id=CVE-2020-11069)) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Admin Tool applications from the site's main entry script instead of the dedicated typo3/ directory.
Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.
Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session.
### Solution
Update to TYPO3 versions 13.4.34 LTS, 14.3.6 LTS that fix the problem described.
### Credits
Thanks to Hổ Cao Từ for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.
CVE-2026-66298 is an origin validation error vulnerability in livebook-dev's livebook software that allows untrusted JavaScript in notebook outputs to trigger session-wide keyboard shortcuts. This can cause forced evaluation of all notebook cells and runtime restarts without user consent. The vulnerability arises because the trusted iframe forwards all keydown events to the parent page without verifying their authenticity, enabling malicious scripts to simulate genuine keystrokes. Affected versions include 0.5.0 before 0.18.7 and 0.19.0 before 0.19.9.
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.