midscene @midscene/web vulnerabilities

Latest midscene @midscene/web CVEs

Newest publication first

1. CVE-2026-59804 Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket

   Published 2026-07-08

   High·CVSS 7.6 EPSS 0.31%

   Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-origin WebSocket connection to the local Sock...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.