High 8.8Published Jul 30, 2026

CVE-2026-66420MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments

Updated under an hour ago (Oct 28, 2026, 1:10 PM ET)

Does this affect you?

It affects Ylianst MeshCentral. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Ylianst MeshCentral

Exploited in the last 30 days

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-346
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Sep 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Ylianst MeshCentral ylianst:meshcentral (from the name)	1.1.21	CNA record

References

References

https://github.com/Ylianst/MeshCentral/pull/7882	product, patch
https://github.com/Ylianst/MeshCentral/commit/f04c9f4	patch
https://github.com/Ylianst/MeshCentral	product
https://www.vulncheck.com/advisories/meshcentral-cross-site-websocket-hijacking-via-origin-validation-bypass-on-self-signed-certificate-deployments	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.