The Pydantic HTTPX2 library contains a critical vulnerability where WebSocket traffic is transmitted in plaintext when routed through a SOCKS5 proxy, allowing for interception and impersonation.

The vulnerability stems from a failure to initiate TLS for WebSocket Secure (wss) connections when using a SOCKS5 proxy, as the library only validates https connections for TLS upgrades. This issue is unauthenticated and affects the Client.websocket() and AsyncClient.websocket() methods.

Successful exploitation of this flaw allows an attacker positioned on the network path to read or modify sensitive data, including Authorization headers, cookies, and query parameters. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to full account takeover or unauthorized data access, potentially resulting in significant reputational damage and data breaches.

Immediate Action: Update the HTTPX2 library to version 2.10.0 or later and ensure that the underlying httpcore2 dependency is also upgraded to version 2.10.0.

Proactive Monitoring: Review application logs for unusual WebSocket connection patterns or traffic originating from unexpected network segments, particularly those involving proxy configurations.

Compensating Controls: Implement transport-layer encryption (such as VPN or TLS-terminating proxies) that operates independently of the application logic to ensure traffic remains encrypted until it reaches the intended destination.

Public Exploit Available: No

This vulnerability presents a significant risk to the confidentiality and integrity of applications relying on HTTPX2 for WebSocket communications. Organizations should prioritize the update to version 2.10.0 across all development and production environments immediately to eliminate the possibility of plaintext credential exposure.