Log in Start free

Vulnerability · Published Apr 23, 2026 · Assigned by redhat

CVE-2025-66286Webkitgtk: authorization bypass through webpage::send-request signal handler

Medium 4.7

In plain English

A medium-severity authorization bypass via user-controlled key in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.2%top 85.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2025-66286
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2025-66286
Ubuntu:22.04:LTSwebkit2gtkno fix listedUBUNTU-CVE-2025-66286
Ubuntu:24.04:LTSwebkit2gtkno fix listedUBUNTU-CVE-2025-66286
Ubuntu:26.04:LTSwebkit2gtkno fix listedUBUNTU-CVE-2025-66286
Ubuntu:26.10webkit2gtkno fix listedUBUNTU-CVE-2025-66286
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2025-66286

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

References