{"id":"CVE-2026-50571","kind":"vulnerability","aliases":["CVE-2026-50571"],"related":[],"title":"WebSub subscribers may reflect hub challenge as HTML, enabling script injection","description":"WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demonstration site.","summary":"The WebSub W3C recommendation's intent-verification step has subscribers echo the hub.challenge value without requiring safe content typing or disabled MIME sniffing. An attacker can use a crafted verification request to run HTML or JavaScript in the subscriber's origin, reading session-bound data and browser storage.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","subscriber-apps","web-frameworks","websub"],"not_affected_if":["challenge-not-reflected","no-websub-subscriber"],"how_to_check":"- Find WebSub subscriber endpoints that answer hub.challenge verification requests, and check whether they return the challenge with a `text/html` or sniffable content type.\n- Check whether responses send `X-Content-Type-Options: nosniff`.","fix":"- Return the challenge only as a safe, non-HTML media type such as `text/plain` and set `X-Content-Type-Options: nosniff` on that response.\n- unknown for specific vendor patches; the sources do not name fixed framework versions.","status":"open","published_at":"2026-10-27T23:17:05+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","triaged_at":"2026-10-27T23:31:23+00:00","updated_at":"2026-10-27T23:31:23+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T23:31:23Z","model":"claude-haiku-5-5","output":{"fix":"- Return the challenge only as a safe, non-HTML media type such as `text/plain` and set `X-Content-Type-Options: nosniff` on that response.\n- unknown for specific vendor patches; the sources do not name fixed framework versions.","reach":"internet","title":"WebSub subscribers may reflect hub challenge as HTML, enabling script injection","impact":"medium","summary":"The WebSub W3C recommendation's intent-verification step has subscribers echo the hub.challenge value without requiring safe content typing or disabled MIME sniffing. An attacker can use a crafted verification request to run HTML or JavaScript in the subscriber's origin, reading session-bound data and browser storage.","category":"other","nicknames":[],"who_cares":["websub","subscriber-apps","web-frameworks"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker script runs in victim origin, reading session data and storage","analyst_note":"Identify which WebSub subscriber frameworks echo hub.challenge as text/html and confirm vendor fixed versions via the NVD entry and the W3C WebSub advisory.","how_to_check":"- Find WebSub subscriber endpoints that answer hub.challenge verification requests, and check whether they return the challenge with a `text/html` or sniffable content type.\n- Check whether responses send `X-Content-Type-Options: nosniff`.","needs_analyst":true,"not_affected_if":["no-websub-subscriber","challenge-not-reflected"],"who_is_affected":"Applications acting as WebSub subscribers that echo hub.challenge in responses served from their own origin are the exposed case. Systems that only receive content through a hub, or that never serve verification responses from an authenticated origin, are less exposed. The advisory does not name specific products or versions.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":3595,"output_tokens":658,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-50571':14A,17A '20180123':93C 'action':180C 'address':239C 'advisori':249C 'allow':224C 'also':107C 'altern':193C 'app':21B 'application/octet-stream':219C 'attack':51B,128C,201C 'attacker-control':200C 'bound':71B 'browser':74B,142C,186C 'bypass':209C 'callback':136C 'challeng':6A,111C,156C 'contain':148C 'content':44B,163C,231C 'control':202C 'craft':55B,145C 'cve':12A,15A 'data':72B,177C 'demonstr':245C,257C 'describ':241C 'disabl':47B,124C 'echo':37B,103C 'enabl':9A 'establish':252C 'execut':160C 'exist':172C 'expos':108C,181C 'framework':24B,114C 'grant':188C 'group':87C 'html':8A,60B,149C 'hub':5A,110C 'hub.challenge':39B,105C 'impact':254C 'initi':130C 'inject':11A 'intent':32B,96C 'intent-verif':31B,95C 'javascript':62B,151C 'localstorag':182C 'may':3A 'media':121C,226C 'mime':48B,125C,221C 'need':237C 'nosniff':234C 'obtain':134C 'option':233C 'origin':67B,167C,191C,205C 'perform':179C 'permiss':187C 'possibl':217C 'practic':253C 'privat':176C 'produc':81C 'protocol':98C 'read':68B,175C 'rec':91C 'rec-websub':90C 'recommend':29B,80C,89C 'redirect':139C 'reflect':4A,162C,246C 'remain':216C 'request':57B,147C 'requir':42B,99C,118C 'resourc':207C 'respons':120C,197C 'return':154C 'rock':244C 'run':59B 'safe':43B,119C,225C 'same-origin':203C 'scenario':242C 'script':10A,206C,211C 'script-src':210C 'self':213C 'session':70B,173C 'session-bound':69B 'sessionstorag':184C 'site':258C 'snif':49B,126C,222C 'social':84C 'src':212C 'step':34B 'storag':75B 'subscrib':2A,20B,36B,65B,101C,152C,166C 'subscriber-app':19B 'subscript':132C 'text/html':158C 'type':45B,122C,227C,232C 'url':137C 'use':53B,168C,194C 'valu':40B,106C 'verif':33B,56B,97C,146C,196C 'victim':141C,170C 'w3c':28B,79C 'web':23B,85C 'web-framework':22B 'websub':1A,25B,27B,76C,92C,243C 'without':41B 'work':86C 'x':230C 'x-content-type-opt':229C","nicknames":[],"mitigations":[],"who_affected":"Applications acting as WebSub subscribers that echo hub.challenge in responses served from their own origin are the exposed case. Systems that only receive content through a hub, or that never serve verification responses from an authenticated origin, are less exposed. The advisory does not name specific products or versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-50571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50571","severity":null,"published_at":"2026-10-27T23:17:05+00:00","modified_at":"2026-10-27T23:17:05+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","fetched_at":"2026-10-27T23:29:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}