# CVE-2023-2850: NodeBB cross-origin WebSocket session hijacking

Source: https://junglewise.ai/threats/cve-2023-2850-nodebb-cross-origin-websocket-session-hijacking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-2850 · Severity: low · CVSS 3.1 · Published 2023-07-25

NodeBB is a popular Node.js-based forum platform that uses WebSockets for real-time communication between the server and clients. An attacker can hijack a user's WebSocket session by tricking them into visiting a malicious website while they are logged into a NodeBB forum. This allows the attacker to intercept and read the victim's private messages and posts without requiring valid credentials.

Technologies: [NodeBB](https://junglewise.ai/threats/technologies/nodebb). Vendors: [NodeBB](https://junglewise.ai/threats/vendors/nodebb).

## Quick answers

**Is CVE-2023-2850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-2850 being exploited in the wild.

**How severe is CVE-2023-2850?** Low severity, with a CVSS score of 3.1, published 25 July 2023.

**Which products and versions are affected?** NodeBB 3.0.0 - 3.1.2, < 2.8.13.

**Is there a fix for CVE-2023-2850?** A patch was published on 2023-05-15: Fixed in NodeBB v3.1.3 and v2.8.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-2850 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-2850?** Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing origin validation flaw (CWE-1385, CWE-346) in the WebSocket handshake process. NodeBB did not validate CSRF tokens during WebSocket connection establishment, allowing cross-origin requests to hijack active sessions. An attacker on a different domain can initiate a WebSocket connection to the target NodeBB server using the victim's authenticated browser session (which automatically includes the session cookie). The fix involves sending a CSRF token as a query parameter during the WebSocket handshake and validating it server-side to ensure the connection originates from the legitimate NodeBB domain. No user interaction beyond visiting a malicious page is required to trigger the vulnerability; the attack is performed automatically via JavaScript.

## Affected products

- NodeBB NodeBB 3.0.0 - 3.1.2, < 2.8.13

## Identifiers

- CVE-2023-2850
- GHSA-4qcv-qf38-5j3j

## Timeline

- 2023-07-25: disclosed: Vulnerability publicly disclosed
- 2023-05-15: patched: Fixed in NodeBB v3.1.3 and v2.8.13

## References

- [https://github.com/NodeBB/NodeBB/security/advisories/GHSA-4qcv-qf38-5j3j](https://github.com/NodeBB/NodeBB/security/advisories/GHSA-4qcv-qf38-5j3j)
- [https://github.com/NodeBB/NodeBB/commit/51096ad2345fb1d1380bec0a447113489ef6c359](https://github.com/NodeBB/NodeBB/commit/51096ad2345fb1d1380bec0a447113489ef6c359)
- [https://github.com/NodeBB/NodeBB/commit/62e162cf1e735e42462be1db9b4954b5a69accdf](https://github.com/NodeBB/NodeBB/commit/62e162cf1e735e42462be1db9b4954b5a69accdf)
- [https://github.com/NodeBB/NodeBB/commit/a5d92da9ddac5607ab7f737520a66eaed6d3ddee](https://github.com/NodeBB/NodeBB/commit/a5d92da9ddac5607ab7f737520a66eaed6d3ddee)
- [https://github.com/NodeBB/NodeBB](https://github.com/NodeBB/NodeBB)
- [https://github.com/NodeBB/NodeBB/releases/tag/v3.1.3](https://github.com/NodeBB/NodeBB/releases/tag/v3.1.3)

## Related threats

- [NodeBB authorization bypass in user registration](https://junglewise.ai/threats/cve-2026-120007-nodebb-1-18-0-through-4-16-5-contains-an-authorization-bypass)
- [NodeBB author spoofing via unvalidated ActivityPub attributedTo field](https://junglewise.ai/threats/cve-2026-58593-nodebb-author-spoofing-via-unvalidated-activitypub-attributedto)
- [NodeBB SQL injection in search-categories endpoint](https://junglewise.ai/threats/cve-2025-50979-nodebb-sql-injection-in-search-categories-endpoint)
- [NodeBB persistent cross-site scripting in profile](https://junglewise.ai/threats/cve-2024-57041-nodebb-persistent-cross-site-scripting-in-profile)
- [NodeBB incorrect access control in admin tabs](https://junglewise.ai/threats/cve-2024-29316-nodebb-incorrect-access-control-in-admin-tabs)