Skip to content
Threat Feed
Subscribe

Product

Java-Client (>= 8.2.1, <= 10.1.0)

1 brief RSS
high advisory

Appium Java Client Allows Network Pivot via Unvalidated directConnect Redirect (CVE-2026-43910)

A vulnerability, CVE-2026-43910, in Appium's java-client allows a malicious Appium server to redirect all subsequent session traffic to an arbitrary internal endpoint by injecting unvalidated `directConnectHost` and `directConnectPort` parameters when `directConnect(true)` is enabled, potentially leading to session traffic interception, network pivoting, and cloud credential theft.

java-client supply-chain vulnerability network-pivot credential-theft java CI/CD
3t 1i