CVE-2026-85183: Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Taipy deployments through version 4.1.1 are affected when their socket.io server uses the described wildcard CORS origin configuration with credentials enabled. A victim application must be reachable by a victim's browser for an attacker-controlled webpage to initiate the connection.
What does an attacker need to exploit this issue?
The attacker needs to induce a user to visit an arbitrary attacker-controlled webpage. No authentication or other privileges are required by the attacker, but the victim's browser must have credentials that are accepted by the Taipy application.
What can an attacker do through the hijacked connection?
An attacker can establish a credentialed socket.io session from another origin and invoke state-variable modifications and action callbacks. The described behavior has no CSRF protection for these operations.