{"id":"CVE-2026-114366","kind":"vulnerability","aliases":["CVE-2026-114366"],"related":[],"title":"Qt WebSockets: authentication handling leaks information to attackers","description":"An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.","summary":"The Qt Framework's QWebSocket authentication handling in the Qt WebSockets module discloses information. An attacker may read data that should stay private, according to the NVD entry (CVSS 2.3, low).","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","qt","qwebsocket","runtime"],"not_affected_if":["no-qt-websockets"],"how_to_check":"- Check whether the application uses the Qt WebSockets module (QWebSocket) and which Qt version it links against","fix":null,"status":"open","published_at":"2026-11-06T05:18:20+00:00","first_seen_at":"2026-11-06T05:40:16+00:00","triaged_at":"2026-11-06T05:41:12+00:00","updated_at":"2026-11-06T05:41:12+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-06T05:41:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Qt WebSockets: authentication handling leaks information to attackers","impact":"low","summary":"The Qt Framework's QWebSocket authentication handling in the Qt WebSockets module discloses information. An attacker may read data that should stay private, according to the NVD entry (CVSS 2.3, low).","audience":"developers","category":"runtime","nicknames":[],"who_cares":["qt","qwebsocket","c++"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Information disclosure of data handled during WebSocket authentication","analyst_note":"Find the affected Qt version ranges and fixed release in the NVD entry or Qt advisories; the sources give no version or fix.","how_to_check":"- Check whether the application uses the Qt WebSockets module (QWebSocket) and which Qt version it links against\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-qt-websockets"],"who_is_affected":"Applications built with the Qt WebSockets module that use QWebSocket for authentication. The sources do not say which Qt versions are affected or what specific information leaks. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000646,"input_tokens":4170,"output_tokens":458,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-114366':11A,14A '-2026':10A,13A '2.3':48B 'accord':42B 'attack':8A,34B 'authent':3A,24B,59C 'c':15B 'cve':9A,12A 'cvss':47B 'data':37B 'disclos':31B 'disclosur':52C 'entri':46B 'framework':21B,57C 'handl':4A,25B,60C 'inform':6A,32B,51C 'leak':5A 'low':49B 'may':35B 'modul':30B,65C 'nvd':45B 'privat':41B 'qt':1A,16B,20B,28B,56C,63C 'qwebsocket':17B,23B,58C 'read':36B 'runtim':18B 'stay':40B 'vulner':53C 'websocket':2A,29B,64C","nicknames":[],"mitigations":[],"who_affected":"Applications built with the Qt WebSockets module that use QWebSocket for authentication. The sources do not say which Qt versions are affected or what specific information leaks. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","low","qt","qwebsocket","runtime"],"campaign_type":null,"search_a":"'-114366':11A,14A '-2026':10A,13A 'attack':8A 'authent':3A 'cve':9A,12A 'handl':4A 'inform':6A 'leak':5A 'qt':1A 'websocket':2A","search_b":"'2.3':48B 'accord':42B 'attack':34B 'authent':24B 'c':15B 'cvss':47B 'data':37B 'disclos':31B 'entri':46B 'framework':21B 'handl':25B 'inform':32B 'low':49B 'may':35B 'modul':30B 'nvd':45B 'privat':41B 'qt':16B,20B,28B 'qwebsocket':17B,23B 'read':36B 'runtim':18B 'stay':40B 'websocket':29B","search_c":"'authent':59C 'disclosur':52C 'framework':57C 'handl':60C 'inform':51C 'modul':65C 'qt':56C,63C 'qwebsocket':58C 'vulner':53C 'websocket':64C","first_public_at":"2026-11-06T05:18:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:Green","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114366","severity":null,"published_at":"2026-11-06T05:18:20+00:00","modified_at":"2026-11-06T05:18:20+00:00","first_seen_at":"2026-11-06T05:40:16+00:00","fetched_at":"2026-11-06T05:40:16+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}