CVE-2026-66420

Name of the Vulnerable Software and Affected Versions MeshCentral version 1.1.21

Description A cross-site WebSocket hijacking protection bypass occurs when self-signed certificates are used. This is caused by an unconditional early return in the CheckWebServerOriginName() function within webserver.js. Unauthenticated remote attackers can establish cross-origin WebSocket connections to any of the twelve WebSocket endpoints and send crafted action commands to exfiltrate the server sessionKey used to sign session cookies. This allows attackers to forge session tokens as arbitrary users and gain full remote control of all managed devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.