Executive brief
WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly
Affected products
- Go github.com/SpectoLabs/hoverfly
Junglewise Threat Intelligence
CVE-2025-54376: GO-2025-3945 - WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly
CVE-2025-54376 · Severity: medium · CVSS 4 · Published 2025-09-17
Technologies: github.com/SpectoLabs/hoverfly (Go). Vendors: Go.
Related threats
- Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any time
- Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function wri
- GO-2025-3944 - Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly
- GO-2024-3108 - Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly