CVE-2026-111617 — WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints
WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoi…
Published: 2026-10-16 · CVSS: 6.9 · CVSS 4.0
WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7