CVE-2025-54376 – Hoverfly’s WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when –auth is enabled.

CVE ID : CVE-2025-54376

Published : Sept. 10, 2025, 8:15 p.m. | 24 minutes ago

Description : Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time application logs (information disclosure) and/or gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. Version 1.12.0 contains a fix for the issue.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…