CVE-2026-43910High· 8.2▾ Twilightjava-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.3%
When directConnect(true) is enabled, appium/java-client unconditionally
accepts directConnectHost, directConnectPort, and directConnectPath
from the server's NEW_SESSION response and silently redirects all subsequent
session traffic to the attacker-specified endpoint — with no allowlist,
no host validation, and no user notification.
AppiumCommandExecutor.java (line 196–219): setDirectConnect() builds
a new URL from server-supplied fields and calls overrideServerUrl(newUrl)
without validating host/IP.DirectConnect.java: getUrl() constructs protocol://host:port/path
with no allowlist.Only the protocol is validated (must equal "https"). The destination host and port are never checked against any allowlist or denylist.
A rogue server injecting directConnectHost=127.0.0.1:4443 causes the
client to silently redirect all post-session commands:
[bootstrap] POST /wd/hub/session [bootstrap] Injecting directConnect -> https://127.0.0.1:4443/wd/hub [redirect-target] HIT #1: GET /wd/hub/session/poc-session-001/source [redirect-target] HIT #2: DELETE /wd/hub/session/poc-session-001
Original source code unmodified — confirmed via git diff HEAD (empty).
Screenshot 1 — Rogue server capturing redirected traffic:
<img width="887" height="146" alt="1" src="https://github.com/user-attachments/assets/cc28002c-ea20-4ac8-8336-cec632e3c842" />Screenshot 2 — Java client processing response from attacker host:
<img width="788" height="130" alt="2" src="https://github.com/user-attachments/assets/222cbab0-0d53-45b2-847d-6aa4e3b79370" />Add allowlist validation before overrideServerUrl() is called, and/or
block RFC-1918/loopback/link-local destinations by default.
io.appium:java-client >= 8.2.1, <= 10.1.0Upgrade to a patched release:
io.appium:java-client 10.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2026-45723Low· 2.7Omni manages Kubernetes on bare metal, virtual machines, or in a cloud
CVE-2026-61793Medium· 6.9Nuxt OG Image generates OG Images with Vue templates in Nuxt
CVE-2026-77348High· 8.2Wallos is an open-source, self-hostable personal subscription tracker
CVE-2026-78682High· 7.5nltk: NLTK: Server-Side Request Forgery via HTTP Proxy Configuration (CVE-2026-78682)
CVE-2026-12992High· 7.4A flaw was found in Apicurio Registry