https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T07:41:20.378803+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-366848 EUVD-2026-366848 2026-10-06T07:41:20.439284+00:00 EUVD-2026-366848 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71416 fkie_cve-2026-71416 2026-10-06T07:41:20.439324+00:00

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable. Version 0.35.0 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-h46j-26q3-rggf GHSA-h46j-26q3-rggf — Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH) 2026-10-06T07:41:20.439360+00:00

Affected: PyPI: headroom-ai

### Summary The Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable.

### Details The Headroom server defines a WebSocket handler at `ws://<headroom_host>:8787/v1/responses` in `headroom/providers/proxy_routes.py`: ```python @app.websocket("/v1/responses") async def openai_responses_ws(websocket: WebSocket): await proxy.handle_openai_responses_ws(websocket) ``` In the `handle_openai_responses_ws()` method of the `OpenAIHandlerMixin` class, the `Origin` header of the WebSocket client handshake is not checked or verified before calling `websocket.accept()`, which grants any WebSocket client (including malicious clients) access to the server: ```python async def handle_openai_responses_ws(self, websocket: WebSocket) -> None: """WebSocket proxy for /v1/responses (Codex gpt-5.4+).

Newer Codex versions use WebSocket instead of HTTP POST for the Responses API. This handler: 1. Accepts the client WebSocket 2. Receives the first message (``response.create`` request) 3. Opens an…