CVE-2026-71416.

Disclosure summary

### Summary The Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable. ### Details The Headroom server defines a WebSocket handler at `ws://:8787/v1/responses` in `headroom/providers/proxy_routes.py`: ```python @app.websocket("/v1/responses") async def openai_responses_ws(websocket: WebSocket): await proxy.handle_openai_responses_ws(websocket) ``` In the `handle_openai_responses_ws()` method of the `OpenAIHandlerMixin` class, the `Origin` header of the WebSocket client handshake is not checked or verified before calling `websocket.accept()`, which grants any WebSocket client (including malicious clients) access to the server: ```python async def handle_openai_responses_ws(self, websocket: WebSocket) -> None: """WebSocket proxy for /v1/responses (C

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

Original records & references

• NIST NVD record
• CVE Program record
• github.com — Reviewed advisory

PUBLISHED 2026-10-02T19:09:15-04:00
MODIFIED 2026-10-02T19:09:15-04:00
INGESTED 2026-10-06T11:45:17-04:00