A Cross-Site WebSocket Hijacking vulnerability in HKUDS nanobot allows remote attackers to gain full access to the bridge API and hijack user WhatsApp sessions.

The application fails to validate the Origin header during the WebSocket handshake, allowing any website visited by a user to establish a connection to the local WebSocket server. This vulnerability is unauthenticated, as the default configuration disables token-based authentication.

The exploitation of this vulnerability poses a severe risk to user privacy and account integrity. An attacker can hijack active WhatsApp sessions, read private messages, steal authentication credentials, or perform actions on behalf of the user. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to significant data compromise and unauthorized account control.

Immediate Action: Update the HKUDS nanobot software to version 0.1.5 or later, which implements the necessary origin validation.

Proactive Monitoring: Monitor local machine network traffic for unexpected WebSocket connections originating from browser-based processes to the bridge API on port 3001.

Compensating Controls: Ensure that browser extensions or security software are active to block malicious or suspicious cross-origin requests, although an update remains the only definitive fix.

Public Exploit Available: Unknown.

Due to the high severity and the potential for total compromise of the WhatsApp bridge, users must prioritize upgrading to version 0.1.5 immediately. The lack of default authentication combined with the failure to validate origins makes this an accessible target for remote attackers. Failure to patch leaves the underlying messaging session exposed to unauthorized monitoring and manipulation.