CVE-2025-54376 HIGH

CVE-2025-54376: Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.

Vendor Spectolabs
Product hoverfly
Weakness CWE-200 · Info exposure
Published September 10, 2025
Last update September 10, 2025
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time application logs (information disclosure) and/or gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. Version 1.12.0 contains a fix for the issue.

Key dates

02Disclosure timeline

September 10, 2025 CVE published
September 10, 2025 Record updated