Threats affecting pkg:github/headroomlabs-ai/headroom

CVE-2026-71416 is a high-severity improper authentication vulnerability in the Headroom WebSocket server. The server does not validate the Origin header of incoming WebSocket requests, allowing any client with network access to the proxy to connect without authentication. If the OpenAI API key is stored in the OPENAI_API_KEY environment variable, malicious clients can perform arbitrary LLM requests through the proxy. This enables unauthorized use of OpenAI API capabilities, including executing arbitrary instructions and tools. The vulnerability affects Headroom versions prior to 0.35.0 and has a CVSS score of 8.8.