CVE-2026-63288

CVSS 8.3 (high) · published 2026-11-10

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.

Weakness: CWE-306

Source: NVD CVE-2026-63288

References

• https://www.axis.com/dam/public/fa/79/f5/cve-2026-63288pdf-en-US-561260.pdf

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.