CVE-2026-46416CWE-284CWE-488

Microsoft UFO shared WebSocket handler state causes cross-client response hijacking

Medium · published May 27, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocketHandler instance and reuses it for multiple authenticated WebSocket connections. The handler stores per-connection protocol objects in mutable instance fields. Each new WebSocket connection overwrites those fields. Later, message handlers send responses through the shared fields instead of through protocol objects bound to the originating connection. As a result, the most recently connected authenticated client can receive protocol responses that belong to another authenticated client.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00454 · 38.5th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-488 · Exposure of Data Element to Wrong Session
Published
2026-05-27T21:56Z
EPSS history
Timeline
  • 27 MAY 21:56Z
    Microsoft UFO shared WebSocket handler state causes cross-client response hijacking
    cvelistv5