CVE-2026-22689

CVE-2026-22689 describes a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in Mailpit, an email testing tool, affecting versions prior to 1.28.2. This flaw stems from the Mailpit WebSocket server's failure to validate the Origin header, allowing connections from any origin. An attacker can exploit this by tricking a developer running Mailpit locally into visiting a malicious website, which then establishes a WebSocket connection to the victim's Mailpit instance. The vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity requiring user interaction, leading to high confidentiality impact. Successful exploitation allows an attacker to intercept sensitive data like email contents, headers, and server statistics in real-time. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness.