Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Cline Kanban Server versions 2.13.0 and earlier allow attackers from other websites to hijack WebSocket connections, potentially taking control of the server or stealing sensitive data. This happens because the server doesn't properly verify that connection requests come from trusted sources.

A cross-origin WebSocket hijacking vulnerability exists in Cline Kanban Server ≤2.13.0 where insufficient origin validation allows attackers to establish WebSocket connections from malicious domains (CWE-1385: Inadequate Encoding of Output; CWE-306: Missing Authentication for Critical Function). An attacker can craft a malicious webpage that, when visited by a user with an active Cline session, establishes an authenticated WebSocket channel to the target server, potentially achieving command execution or data exfiltration.