---
id: "CVE-2026-50571"
kind: "vulnerability"
aliases: ["CVE-2026-50571"]
title: "WebSub subscribers may reflect hub challenge as HTML, enabling script injection"
severity: "medium"
cvss: 5.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "subscriber-apps", "web-frameworks", "websub"]
not_affected_if: ["challenge-not-reflected", "no-websub-subscriber"]
published_at: "2026-10-27T23:17:05+00:00"
first_seen_at: "2026-10-27T23:29:44+00:00"
updated_at: "2026-10-27T23:31:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50571", "first_seen_at": "2026-10-27T23:29:44+00:00"}]
---

# WebSub subscribers may reflect hub challenge as HTML, enabling script injection

The WebSub W3C recommendation's intent-verification step has subscribers echo the hub.challenge value without requiring safe content typing or disabled MIME sniffing. An attacker can use a crafted verification request to run HTML or JavaScript in the subscriber's origin, reading session-bound data and browser storage.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find WebSub subscriber endpoints that answer hub.challenge verification requests, and check whether they return the challenge with a `text/html` or sniffable content type.
- Check whether responses send `X-Content-Type-Options: nosniff`.

## Fix

- Return the challenge only as a safe, non-HTML media type such as `text/plain` and set `X-Content-Type-Options: nosniff` on that response.
- unknown for specific vendor patches; the sources do not name fixed framework versions.

## Timeline

- 2026-10-27T23:29:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50571

## From the sources

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demonstration site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_