GHSA-8r62-w5wh-fc5m: Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
Summary
Mailpit versions 1.29.0 through 1.30.5 have a security bypass in their WebSocket (a two-way communication protocol) origin check. An attacker can use percent-encoding (a way to represent characters as %HH codes) to bypass the security gate, for example by requesting /%61pi/events instead of /api/events, allowing them to receive sensitive email information like subjects and snippets without permission. This is a regression of a previously fixed vulnerability.
Solution / Mitigation
The source suggests two approaches: (1) 'Do not make security decisions on r.RequestURI. Key the check on r.URL.Path, the decoded value the router uses, so the gate and the route agree.' (2) 'Better, restore a real CheckOrigin on the upgrader so the WebSocket carries its own origin enforcement rather than depending on a middleware prefix match.'
Vulnerability Details
EPSS: 0.0%
Yes
August 20, 2026
Classification
Affected Packages
Original source: https://github.com/advisories/GHSA-8r62-w5wh-fc5m
First tracked: August 20, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 95%