Description
Affected versions of the console-io package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As console-io allows terminal access on the server via a web page, an authentication bypass is essentially remote code execution.
Recommendation
Update the console-io package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.3.0
- Patched version(s): 2.3.0
References
Could your website be exposed too?
SmartScanner can check your website for Authentication Bypass in console-io and gives you actionable findings to investigate.
Start a free scanRelated Issues
- FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985
- LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header - CVE-2026-39411
- Sanitization bypass using HTML Entities in marked - CVE-2016-10531
- @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass - CVE-2024-34065
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023