CVE-2026-97363
HighCVSS 7.5Summary
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
Risk Assessment
This can lead to system overload or user account compromise, threatening availability and data confidentiality.
Recommendation
Implement rate limiting mechanisms for authentication requests in the WebSocket interface.
Other vulnerabilities in WebSocket API
See all- CVE-2026-7703High
A flaw has been found in AV Stumpfl Pixera Two Media Server up to version 25.2 R2 in an unknown function of the Websocket API component, allowing for code injection. The attack can be initiated remotely.
- CVE-2026-10825High
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.
Original NVD description (English source)
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS