CVE-2025-54376: Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-10 · updated 2026-06-17
Weakness: CWE-200

Description

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time application logs (information disclosure) and/or gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. Version 1.12.0 contains a fix for the issue.

Affected products

SpectoLabs hoverfly: before 1.12.0 — fixed in 1.12.0

How to fix

Upgrade to a fixed version: SpectoLabs hoverfly 1.12.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-54376 or the next vulnerability affects your stack