AIKIDO-2026-149129

@midscene/web is vulnerable to Missing Authentication for Critical Function

Missing Authentication for Critical FunctionCVE-2026-59804 Published 2 days ago

Medium Risk

This Affects:

@midscene/web

0.8.17 - 1.10.3

Fixed in 1.10.4

Are you affected? Scan for Free

TL;DR

Midscene bridge mode starts a local Socket.IO server that brokers browser automation commands between the CLI and the Chrome extension. The server is created with no CORS configuration, no Origin header validation, and no authentication token, so any web page loaded in the user's browser can open a cross-origin WebSocket connection to it. A connecting page can seize the single client slot to intercept and inject automation commands and read command-payload data, or immediately shut the server down by including the MIDSCENE_BRIDGE_SIGNAL_KILL query parameter. The fix restricts connections to trusted origins by validating the Origin header on every Socket.IO handshake.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run Midscene in bridge mode, which starts the local Socket.IO bridge server. Exploitation additionally requires the user to visit an untrusted/externally-controlled web page while a bridge session is active.