Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-59804
web-infra-dev midscene — Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N H N N P H H N 7.6 .0031 22.1 —
AFFECTED
Product Versions Fixed
midscene unspecified 86f4118d1d847041c63d79e347e08c87c3f1a882
TIMELINE
Jul 7 Reserved by VulnCheck
Jul 8 Published (CNA: VulnCheck)
Oct 8 EXPLOIT PUBLISHED — CVE-2026-59804 (web-infra-dev midscene). Public exploit reference added.
Description
Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-origin WebSocket connection to the local Socket.IO server, which performs no Origin header validation and requires no authentication token. Attackers can connect from any web page visited by the victim to seize the single-client slot, intercept and inject automation commands, exfiltrate command-payload data, or unconditionally terminate the server by supplying the MIDSCENE_BRIDGE_SIGNAL_KILL query parameter.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| July 7, 2026 | Reserved | Reserved by VulnCheck |
| July 8, 2026 | Published | Published (CNA: VulnCheck) |
| October 8, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-59804 (web-infra-dev midscene). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| web-infra-dev | midscene | — | — | 86f4118d1d847041c63d79e347e08c87c3f1a882 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-59804 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
