AIKIDO-2026-593378

TL;DR

The WebSocket upgrade handler accepts cross-origin upgrade requests carrying the session cookie without validating the handshake Origin, and the upgrade path bypasses the CORS middleware used by the REST and GraphQL transports. A browser attaches the session cookie automatically, so a page on an untrusted origin can open a WebSocket that is authenticated as the visiting user. Over that connection it can read, create, update, and delete records in any collection the victim can access, extending to system collections when the victim is an administrator. The fix enforces an allowed-origin check on WebSocket connections.