Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-11-06T04:40:04 qt6-qtwebsockets: Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-201

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

A flaw was found in Qt. Improper authentication handling in the QWebSocket component of the Qt WebSockets module allows an attacker to cause an information disclosure. A remote attacker could exploit this vulnerability to gain unauthorized access to sensitive data.

An information disclosure vulnerability exists in Qt Framework's QWebSocket authentication handling within the Qt WebSockets module, where improper handling of authentication credentials or state during WebSocket handshakes allows an unauthenticated remote attacker to expose sensitive information. Disable unauthenticated WebSocket endpoints or restrict network access to trusted clients via reverse proxy authentication controls until an update can be applied. Red Hat Enterprise Linux 10 Fix deferred qt6-qtwebsockets Red Hat Hardened Images Fix deferred qt5 Red Hat Hardened Images Fix deferred qt6 https://www.cve.org/CVERecord?id=CVE-2026-114366 https://nvd.nist.gov/vuln/detail/CVE-2026-114366 https://codereview.qt-project.org/c/qt/qtwebsockets/+/772273 https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-114366