SEC: WebSocket Accepts Unauthenticated Connections

[vybe]

Pentest Finding 3.2.1 — Medium (CVSS 6.9)

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Location: ws://host/ws — main.py lines 355–364

Impact

The WebSocket endpoint accepts TCP upgrade and establishes a connection without any authentication. An unauthenticated attacker can receive real-time platform activity broadcasts including:

• Agent status changes, task progress, activity feed events
• Agent names, activity types, task identifiers
• PII leaks (e.g., shared_with email addresses in agent_shared events)
• Process execution details and error messages

Root Cause

main.py lines 355–364 call websocket.accept() before performing any authentication check.

Steps to Reproduce

A PoC script (ws_vuln_tests.py) demonstrates that connecting without auth yields real-time events:

• agent_activity events with model names, execution IDs, message previews
• agent_shared events with PII (shared_with: user2@user.com)
• process_event events with process names and execution details

Remediation

• Reject WebSocket upgrade requests that do not provide a valid bearer token before calling websocket.accept()
• If browser clients cannot send Authorization headers during WebSocket upgrade, implement a short-lived ticket pattern: exchange a JWT for a one-time WebSocket ticket via an authenticated POST, then use the ticket in the WS URL with a 30-second TTL

References

• WebSocket Security Cheat Sheet
• CWE-306: Missing Authentication for Critical Function

Source: UnderDefense Web Pentest Report, March 2026