Unauthenticated Access to Admin WebSocket Log Streaming Endpoint in Hoverfly .

An authentication bypass vulnerability was identified in Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs, which is not protected by the authentication middleware applied to the REST admin API. As a result, an unauthenticated remote attacker can connect to the WebSocket endpoint and stream real-time application logs. This exposes potentially sensitive information, including internal file paths, proxied request and response bodies, tokens, and other confidential data written to logs, leading to significant information disclosure risk.