CVE-2026-66420

HighCVSS 8.8/10Last modified Sep 9, 2026

Description

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-346

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 30, 2026
Last modified: Sep 9, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-664219.3OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary Ja CVE-2026-664228.1Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within t CVE-2026-664249.8Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.CVE-2026-664256.5Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1 CVE-2026-664267.1Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.CVE-2026-664277.6Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.CVE-2026-664284.3Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.CVE-2026-664297.1Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-66439.9A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and CVE-2026-664308.5Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-664317.5Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.CVE-2026-664327.5Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.