Tag
The Cline Hub dashboard fails to validate Origin headers and bypasses authorization when no secret is configured, allowing malicious websites to hijack local WebSocket connections to execute arbitrary code.