CVE Vulnerabilities

CVE-2024-10956

Origin Validation Error

Published: Mar 20, 2025 | Modified: Jul 15, 2025
CVSS 3.x
7.1
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an attacker to hijack an existing WebSocket connection between the victims browser and the server, enabling unauthorized actions such as deleting conversation history without the victims consent. The issue arises due to insufficient WebSocket authentication and lack of origin validation.

Weakness

The product does not properly verify that the source of data or communication is valid.

Affected Software

Name Vendor Start Version End Version
Gpt_academic Binary-husky 3.83 (including) 3.83 (including)

References