Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck

CVE-2026-66420MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments

High 8.8

In plain English

A high-severity security flaw in MeshCentral from Ylianst. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.2%top 87.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

Affected products (as reported)

Vendor	Product	Versions
Ylianst	MeshCentral	1.1.21

Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Pull Request product, patch
Merge Commit patch
Product Repository product
https://www.vulncheck.com/advisories/meshcentral-cross-site-websocket-hijacking-via-origin-validation-bypass-on-self-signed-certificate-deployments third-party-advisory