CVE-2026-111617 Details

A missing authentication vulnerability has been identified in WHartTest versions through 2.8.1. This vulnerability allows unauthenticated attackers to connect to the WebSocket endpoints '/ws/ui/web/' and '/ws/ui/actuator/'. The issue arises because the 'UiAutomationConsumer' accepts all connections without authentication. Exploitation of this vulnerability enables attackers to register an actuator with a client-supplied ID, intercept test-case payloads from other users, receive broadcast step results, and spoof results and screen frames into the sessions of targeted users.

To address this vulnerability, implement authentication for WebSocket connections. This can be done by adding a JWT-aware 'AuthMiddlewareStack' around the WebSocket 'URLRouter', requiring verified tokens for actuator connections, and routing results through per-user groups to prevent cross-user interference.