Ylianst MeshCentral 1.1.21 WebSocket Endpoint webserver.js CheckWebServerOriginName cross-domain policy

Summaryinfo

A vulnerability was found in Ylianst MeshCentral 1.1.21. It has been classified as problematic. The impacted element is the function CheckWebServerOriginName of the file webserver.js of the component WebSocket Endpoint. Performing a manipulation results in cross-domain policy. This vulnerability was named CVE-2026-66420. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Ylianst MeshCentral 1.1.21. It has been classified as problematic. This affects the function CheckWebServerOriginName of the file webserver.js of the component WebSocket Endpoint. The manipulation with an unknown input leads to a cross-domain policy vulnerability. CWE is classifying the issue as CWE-942. The product uses a cross-domain policy file that includes domains that should not be trusted. This is going to have an impact on confidentiality. The summary by CVE is:

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-66420 since 07/27/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/31/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Ylianst

Name

• MeshCentral

Version

• 1.1.21

Website

• Product: https://github.com/Ylianst/MeshCentral/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion