PT-2025-12086 · Unknown · Gpt Academy

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-10956

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions GPT Academy version 3.83

Description GPT Academy version 3.83 is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting conversation history without the victim's consent. The issue arises due to insufficient WebSocket authentication and lack of origin validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Origin Validation Error

Weakness Enumeration

CWE-284

CWE-346

Related Identifiers

CVE-2024-10956

Affected Products

Gpt Academy

References · 7

• 🔥 https://huntr.com/bounties/0f8403ad-5f60-4eb9-9f51-8fbd2e41eda4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10956 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10956 · Vendor Advisory
• https://t.me/cvenotify/128973 · Telegram Post
• https://twitter.com/cybercronai/status/1903091937604952205 · Twitter Post
• https://t.me/cvenotify/128869 · Telegram Post
• https://twitter.com/CVEnew/status/1902670956071735379 · Twitter Post