CVE-2025-66286 MEDIUM

CVE-2025-66286: Webkitgtk: authorization bypass through webpage::send-request signal handler

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Weakness CWE-639 · IDOR
Published April 23, 2026
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.

Key dates

02Disclosure timeline

April 23, 2026 CVE published
April 28, 2026 Record updated