CVE-2025-54376: 
Analisi e mitigazione delle vulnerabilità

Hoverfly, an open source API simulation tool, contains a vulnerability in versions 1.11.3 and prior where its admin WebSocket endpoint /api/v2/ws/logs is not protected by authentication middleware, even when authentication is enabled. The vulnerability was discovered in September 2025 and assigned CVE-2025-54376 (GitHub Advisory).

The vulnerability stems from a missing authentication check on the WebSocket logs endpoint. While the REST admin API requires credentials when authentication is enabled, the WebSocket endpoint /api/v2/ws/logs remains accessible without authentication. This allows unauthenticated users to establish WebSocket connections and receive real-time application logs. The vulnerability has been assigned a CVSS rating of Moderate (GitHub Advisory).

An unauthenticated remote attacker can stream real-time application logs, potentially gaining access to sensitive information including internal file paths, request/response bodies, tokens, and other data emitted in logs. This represents an information disclosure vulnerability that could expose sensitive operational data (GitHub Advisory).

A fix has been implemented in commit ffc2cc34563de67fe1a04f7ba5d78fa2d4564424 which adds authentication middleware to the WebSocket endpoint. The patch ensures that the same authentication requirements applied to REST endpoints are also enforced for WebSocket connections (GitHub Commit).