CVE-2026-111617

MEDIUM 6.5

WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

CWE	CWE-306
Vendor	mgdaaslab
Product	wharttest
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for mgdaaslab wharttest

Be the first to know when new medium vulnerabilities affecting mgdaaslab wharttest are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

MGdaasLab / WHartTest

0 ≤ 2.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/wharttest-ui-automation-websocket-missing-authentication github.com: https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/wharttest_django/asgi.py#L41-L53 github.com: https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/ui_automation/consumers.py#L129-L186 vulncheck.com: https://www.vulncheck.com/advisories/wharttest-through-2.8.1-missing-authentication-on-ui-automation-websocket-endpoints

Credits

hieuPenguinnn