PatchSiren cyber security CVE debrief
CVE-2026-66420 Ylianst CVE debrief
MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance. The vulnerability exists in MeshCentral 1.1.21 and is caused by an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. This allows attackers to open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance. Administrators and users of MeshCentral 1.1.21, especially those using self-signed certificates, should be aware of this vulnerability and take necessary precautions to prevent exploitation.
- Vendor
- Ylianst
- Product
- MeshCentral
- CVSS
- HIGH 8.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-30
- Original CVE updated
- 2026-07-31
- Advisory published
- 2026-07-30
- Advisory updated
- 2026-07-31
Who should care
Administrators and users of MeshCentral 1.1.21, especially those using self-signed certificates, should be aware of this vulnerability and take necessary precautions to prevent exploitation.
Technical summary
The vulnerability exists in MeshCentral 1.1.21 and is caused by an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. This allows attackers to open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.
Defensive priority
CVE-2026-66420 is rated HIGH with a CVSS score of 8.6, indicating a serious vulnerability in MeshCentral 1.1.21 that could allow unauthenticated remote attackers to hijack administrator sessions.
Recommended defensive actions
- Inventory MeshCentral instances and verify if self-signed certificates are in use.
- Restrict access to WebSocket endpoints to only trusted origins.
- Implement additional monitoring to detect potential exploitation attempts.
- Apply the vendor's remediation as soon as it becomes available.
- Consider using alternative certificate types if possible.
Evidence notes
The vulnerability exists in MeshCentral 1.1.21 and is caused by an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. This allows attackers to open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T23:16:53.527Z and has not been modified since then.