CVE-2025-66902

An input validation issue in in Pithikos websocket-server v.0.6.4 allows a remote attacker to obtain sensitive information or cause unexpected server behavior…

High · published January 20, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

⚡ A sneaky input validation issue in Pithikos websocket-server v0.6.4 could let attackers waltz away with your sensitive data! Think of it like a restaurant where anyone can walk in and shout orders without needing to check in — the kitchen might accidentally whip up something they shouldn't, leading to unexpected (and unappetizing!) results. 🎭 With this vulnerability, an attacker could pull sensitive information from the server or even throw it into chaos, leading to unexpected behaviors. Imagine a diner wreaking havoc in the kitchen; your users' experience could be utterly ruined!

Put simply

Think of it like a restaurant where anyone can walk in and shout orders without needing to check in — the kitchen might accidentally whip up something they shouldn't, leading to unexpected (and unappetizing!) results. 🎭 This input validation flaw in the websocket_server.py component allows malicious messages to slip through the cracks, enabling attackers to manipulate server behavior or extract confidential information without proper checks.

What to do

With this vulnerability, an attacker could pull sensitive information from the server or even throw it into chaos, leading to unexpected behaviors. Imagine a diner wreaking havoc in the kitchen; your users' experience could be utterly ruined! Immediately upgrade your Pithikos websocket-server to v0.6.5 to patch this vulnerability. Additionally, audit your input validation processes to ensure no other sneaky messages can bypass your defenses. 🛡️ You've got this! Follow these steps, and your server will be fortified in no time! 🚀

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Published
2026-01-20T00:00Z
EPSS history
Timeline
  • 20 JAN 00:00Z
    An input validation issue in in Pithikos websocket-server v.0.6.4 allows a remote attacker to obtain sensitive information or cause unexpected server behavior…
    cvelistv5