Unauthenticated Cross-Origin WebSocket Exploitation in Taipy

Taipy versions configured with default socket.io settings are vulnerable to a critical cross-origin configuration flaw (CVE-2026-85183). The application enables both a wildcard Cross-Origin Resource Sharing (CORS) origin policy and the 'credentials' flag within its WebSocket implementation. This combination allows an attacker to host a malicious webpage that forces a victim's browser to establish a credentialed WebSocket connection to the Taipy server. Because the server trusts the origin and processes credentials, the attacker can execute unauthorized state variable modifications and trigger server-side action callbacks. This vulnerability effectively bypasses traditional CSRF protections for the WebSocket channel, potentially leading to full unauthorized control over the Taipy application instance. Defenders must note that this vulnerability resides in the application's configuration of its communication layer, which persists as long as the default socket.io policy remains in place.

Impact

Successful exploitation allows attackers to perform unauthorized actions on behalf of authenticated users, including the modification of internal application state and the execution of server-side logic (action callbacks). This bypass of CSRF protection poses a significant risk to application integrity and data security, particularly in multi-user Taipy deployments where administrative or sensitive user actions are performed.

Recommendation

• Prioritize an audit of Taipy WebSocket configurations to ensure the 'Access-Control-Allow-Origin' header is restricted to trusted, specific domains rather than a wildcard ('*').
• Disable the transmission of credentials (cookies/authorization headers) for cross-origin WebSocket connections if cross-domain access is required.
• Implement strict origin validation logic within the socket.io 'connection' middleware to drop any incoming requests that do not originate from expected application domains.
• Monitor application logs for WebSocket connection attempts originating from unknown or unexpected HTTP 'Origin' headers.