VulnerabilitiesHeadroom AI proxy accepts WebSocket requests from any web page
A GitHub advisory published on 2 October 2026 says the Headroom proxy skips Origin checks and attaches the operator's OpenAI key to attacker-sent requests.
2 Oct 2026
Headroom WebSocket server vulnerable to Cross-Site hijacking (CVE-2026-71416)
The Headroom WebSocket server fails to validate the Origin header of incoming client requests, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication by exploiting the OPENAI_API_KEY environment variable. An attacker can execute unauthorized API calls if they have network access to the Headroom proxy.
Disclosed 2 October 2026 · Record updated 2 October 2026
Impact
Malicious WebSocket clients can perform arbitrary LLM requests and access the OpenAI API without authentication if the OPENAI_API_KEY environment variable is set.
Our coverage
VulnerabilitiesSources
- github.comhttps://github.com/advisories/GHSA-h46j-26q3-rggf