CVE-2026-50571— WebSub: Reflected script execution through intent-verification challenges

Quick assessment

Affected

w3c websub

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WebSub 是由 W3C 社交 Web 工作组（Social Web Working Group）制定的一项 W3C 建议。在建议文档 REC-websub-20180123 中，意图验证协议要求订阅者回显值（部分框架将其暴露为），但该协议并未强制要求使用安全的响应媒体类型，也未要求禁用 MIME 嗅探。攻击者可以发起订阅以获取回调 URL，随后将受害者的浏览器重定向至一个精心构造的验证请求，该请求中包含 HTML 或 JavaScript 内容。若订阅者以媒体类型返回该挑战值，则反射的内容将在订阅者所属

CVSS 5.7 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 3 AI

T1059.007 · JavaScript T1566.002 · Spearphishing Link T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WebSub: Reflected script execution through intent-verification challenges

Source: CVE Program / CVE List V5

Vulnerability Description

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demonstration site.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
w3c	websub	= REC-websub-20180123	-

II. Public POCs for CVE-2026-50571

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-50571

请登录查看更多情报信息。

Other References for CVE-2026-50571 (2)

https://github.com/w3c/websub/security/advisories/GHSA-f4hw-w632-m6wh x_refsource_CONFIRM
https://github.com/aaronpk/websub.rocks/commit/c9e24b8815c0d9f43350f0408ce2aedf9aa78ede x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-50571

IV. Related Vulnerabilities

Same vendor: w3c

Same weakness: CWE-79