AIKIDO-2026-10441

TL;DR

Affected versions of this package are affected by exposure of authentication credentials in the WebSocket URL query string, where sensitive header and payload values are appended directly to the connection URL instead of being sent through the Sec-WebSocket-Protocol header. Because URLs are commonly logged by browsers, proxies, monitoring tools, and intermediary servers, this can lead to unintended credential disclosure. An attacker able to access those logs, browser history, or captured network metadata may recover the leaked values and use them to impersonate the client, hijack the real-time connection, or perform unauthorized actions against the subscription endpoint.