CVE-2026-111617: WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints
WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker who can reach the affected WebSocket endpoints can exploit it. No credentials, user interaction, or special privileges are required.
What access does an attacker gain through the affected endpoints?
An attacker can register an actuator using a client-supplied ID, intercept other users' test-case payloads, receive broadcast step results, and inject spoofed results and screen frames into victim sessions.
How can I determine whether my deployment is affected?
A deployment is affected if it runs WHartTest through 2.8.1 and exposes the /ws/ui/web/ or /ws/ui/actuator/ WebSocket endpoints. The vulnerable behavior is that UiAutomationConsumer accepts connections without authentication.
What can be done if patching is not immediately possible?
Restrict network access to the affected WebSocket endpoints so unauthenticated attackers cannot reach them. Limiting access to trusted users or networks reduces exposure until authentication is enforced.