CVE-2026-85183 affects Taipy, an open-source Python framework for building data applications. The vulnerability stems from Taipy configuring its socket.io server with a wildcard CORS origin ('*') while simultaneously enabling the credentials flag, a misconfiguration that violates browser security rules and enables cross-site WebSocket hijacking. Any malicious web page can establish credentialed WebSocket connections to a victim's Taipy application running in the browser context. Attackers exploiting this flaw can invoke state variable modifications and trigger action callbacks without any CSRF protection in place. The issue affects Taipy through version 4.1.1, as referenced in the vulnerable server configuration file at taipy/gui/server.py. There is no apparent authentication barrier preventing arbitrary domains from initiating socket.io sessions against the victim application. This represents a high-severity web security flaw with potential for unauthorized data manipulation and application state tampering. The vulnerability has been publicly disclosed via VulnCheck advisories and tracked in the Taipy GitHub issue tracker.
