CVE-2026-63288

HighCVSS 8.3/10Last modified Nov 12, 2026

Description

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-63296.5PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched M CVE-2026-632927.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a rem CVE-2026-632939.9A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When import CVE-2026-632949.9A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpackin CVE-2026-632954.3An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When CVE-2026-632969.9An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migratio CVE-2026-632979.9An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass ta CVE-2026-632989.9An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacke CVE-2026-632999.9An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code p CVE-2026-63306.5The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection an CVE-2026-633009.9An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker w CVE-2026-633017.0In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the int