CVE-2026-111617

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

Interception and spoofing of test data — ability to manipulate test results and inject false information. Leads to integrity breach of the testing process and potentially incorrect decisions.

Upgrade WHartTest beyond 2.8.1 once available and implement authentication and authorization for WebSocket connections in UiAutomationConsumer. Until a fix is released, consider restricting access to WebSocket endpoints.