THREAT OPS › Threat News › [GHSA] GHSA-8r62-w5wh-fc5m (medium) — Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
[GHSA] GHSA-8r62-w5wh-fc5m (medium) — Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
GHSA-8r62-w5wh-fc5m Severity: medium CVE: CVE-2026-67448
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
## Summary
The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-22689cve
- CVE-2026-67448cve
- https://evil.example`url
Original source: https://github.com/advisories/GHSA-8r62-w5wh-fc5m