CVE-2025-54376: high-severity vulnerability in SpectoLabs hoverfly
Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 0.7%
exploitation probability
0.7%top 47% of all CVEs
observed exploitation
nono source reports it
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time application logs (information disclosure) and/or gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. Version 1.12.0 contains a fix for the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
SpectoLabs · hoverflyRelated CVEs — SpectoLabs hoverfly
In the same product, most dangerous first.
CVE-2024-45388HIGHArbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)EPSS 55.6%CVE-2025-54123CRITICALHoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationEPSS 10.5%CVE-2026-50018MEDIUMHoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve ActionsEPSS 0.5%CVE-2026-50013HIGHHoverfly: Process Crash via Concurrent Map Write Race Condition in Diff ModeEPSS 0.5%