Description
The Cline Hub dashboard server (@cline/cline-hub), launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOM_SECRET is not set—the default for local (127.0.0.1) binds—isAuthorizedBrowserRequest() returns true unconditionally, allowing any website a developer visits to open a cross-origin WebSocket to ws://127.0.0.1:8787/browser.
Recommendation
Update the cline package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.30
- Patched version(s): 3.0.30
References
Could your website be exposed too?
SmartScanner can check your website for Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability - CVE-2026-44211
- Waku: Cross-Origin CSRF on RSC Server Action Dispatch - CVE-2026-49455
- TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover - @tinacms/app - CVE-2026-55660
- @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion - CVE-2026-73561
You might also like:
See something that needs correcting? Let us knowUpdated September 24, 2026