Headroom (< 0.35.0)

The Headroom WebSocket server lacks Origin header validation, enabling Cross-Site WebSocket Hijacking that allows unauthorized parties to perform LLM requests via an injected OpenAI API key.