CVE-2026-50571

Name of the Vulnerable Software and Affected Versions WebSub (affected versions not specified) Check Point VPN (affected versions not specified)

Description The intent-verification protocol in WebSub does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. If the subscriber returns the hub.challenge (or hub challenge) value as text/html, reflected content can be executed in the subscriber origin. This allows the use of a victim's session to read private data, perform actions, or expose localStorage and sessionStorage. Additionally, the verification response can be used as an attacker-controlled same-origin script resource to bypass script-src 'self', which remains possible with application/octet-stream if MIME sniffing is enabled.

In Check Point VPNs, vulnerabilities in the legacy IKEv1 protocol allow attackers to bypass authentication and establish VPN connections without a valid password. This flaw has been actively exploited in ransomware-linked attacks to grant unauthorized access to corporate networks.

Recommendations For WebSub, implement safe media typing and the X-Content-Type-Options: nosniff header. For Check Point VPN, apply the emergency hotfixes provided by the vendor. Transition from the IKEv1 protocol to the more secure IKEv2 protocol.