{"id":"CVE-2026-63288","kind":"vulnerability","aliases":["CVE-2026-63288"],"related":[],"title":"AXIS OS Secure Entry: WebSocket request bypasses authentication to reach a separate API endpoint","description":"A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.","summary":"A WebSocket request sent to one API endpoint gives access to a different API endpoint without the intended authentication check. An attacker can reach functions they should not be able to call.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AXIS OS Secure Entry","fixed":["12.11.106.1"],"affected":"< 12.11.106.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["access-control","api","axis","axis-os","iot","other","secure-entry","websocket"],"not_affected_if":[],"how_to_check":"Check the firmware version of Axis access-control devices (Secure Entry track, e.g. AXIS A1610, A1601) in the device web UI or AXIS Device Manager; versions older than 12.11.106.1 on the Secure Entry track should be treated as exposed. Affected lower bound not published yet; Axis will disclose details on 10 Nov 2026.","fix":"Update AXIS OS Secure Entry firmware to 12.11.106.1 or later (Axis registry). Axis A1610 and A1601 firmware 12.11.119.4 (2026-09-29) lists this CVE as addressed.","status":"open","published_at":"2026-11-10T06:17:10+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","triaged_at":"2026-11-10T06:22:15+00:00","updated_at":"2026-11-10T06:23:49+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T06:22:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WebSocket request bypasses authentication to reach a separate API endpoint","impact":"high","summary":"A WebSocket request sent to one API endpoint gives access to a different API endpoint without the intended authentication check. An attacker can reach functions they should not be able to call.","audience":"businesses","category":"other","nicknames":[],"who_cares":["websocket","api"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reaches protected API endpoints without authentication","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-63288 and confirm the fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000624,"input_tokens":4500,"output_tokens":347,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-63288 and confirm the fix.","search":"'-2026':16A,19A '-63288':17A,20A 'abl':68B 'access':26B,48B,82C 'access-control':25B 'allow':80C 'api':13A,28B,45B,52B,78C,86C 'attack':60B 'authent':8A,57B,92C 'axi':1A,29B,31B 'axis':21A 'axis-o':30B 'bypass':7A,89C 'call':70B 'check':58B 'control':27B 'cve':15A,18A 'differ':51B 'endpoint':14A,46B,53B,79C,87C 'entri':4A,37B 'entry':24A 'function':63B 'give':47B 'intend':56B,91C 'iot':33B 'layer':93C 'one':44B 'os':2A,22A,32B 'reach':10A,62B 'request':6A,41B,73C 'secur':3A,36B 'secure':23A 'secure-entri':35B 'sent':42B,74C 'separ':12A,85C 'specif':77C 'unauthor':81C 'websocket':5A,38B,40B,72C 'without':54B","nicknames":[],"mitigations":[],"who_affected":"Axis devices running AXIS OS on the Secure Entry firmware track (access-control controllers such as A1610 and A1601 are listed with fixes). Axis rates it 8.3 with an adjacent-network vector (no login needed, attacker on the same network). Axis Powered by Genetec devices are also listed as fixed in 12.11.106.1. Devices on other AXIS OS tracks are not listed for this CVE.","tier":"B","verified":{"fix":{"at":"2026-11-10T06:23:49Z","by":"analyst","doc":"https://techdocs.genetec.com/r/en-US/Security-Updates-for-Axis-Powered-by-Genetec/Resolved-vulnerabilities-in-Axis-Powered-by-Genetec-release-12.11.106.1","run_id":2414}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["axisossecureentry","ossecureentry"],"ptokens":["axis","entry","os","secure"],"labels":["accesscontrol","api","axis","axisos","high","iot","other","secureentry","websocket"],"campaign_type":null,"search_a":"'-2026':16A,19A '-63288':17A,20A 'api':13A 'authent':8A 'axi':1A 'axis':21A 'bypass':7A 'cve':15A,18A 'endpoint':14A 'entri':4A 'entry':24A 'os':2A,22A 'reach':10A 'request':6A 'secur':3A 'secure':23A 'separ':12A 'websocket':5A","search_b":"'abl':68B 'access':26B,48B 'access-control':25B 'api':28B,45B,52B 'attack':60B 'authent':57B 'axi':29B,31B 'axis-o':30B 'call':70B 'check':58B 'control':27B 'differ':51B 'endpoint':46B,53B 'entri':37B 'function':63B 'give':47B 'intend':56B 'iot':33B 'one':44B 'os':32B 'reach':62B 'request':41B 'secur':36B 'secure-entri':35B 'sent':42B 'websocket':38B,40B 'without':54B","search_c":"'access':82C 'allow':80C 'api':78C,86C 'authent':92C 'bypass':89C 'endpoint':79C,87C 'intend':91C 'layer':93C 'request':73C 'sent':74C 'separ':85C 'specif':77C 'unauthor':81C 'websocket':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"product-security@axis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63288","severity":null,"published_at":"2026-11-10T06:17:10+00:00","modified_at":"2026-11-10T06:17:10+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","fetched_at":"2026-11-10T06:20:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63288:2414","url":"https://help.axis.com/en-us/security-advisories","severity":null,"published_at":"2026-11-10T06:23:49+00:00","modified_at":"2026-11-10T06:23:49+00:00","first_seen_at":"2026-11-10T06:23:49+00:00","fetched_at":"2026-11-10T06:23:49+00:00","note":"Axis registry (primary) lists CVE-2026-63288, 8.3, fixed in AXIS OS Secure Entry 12.11.106.1; full details due 10 Nov 2026. A1610/A1601 12.11.119.4 release notes confirm addressed. Affected lower bound and exact mechanism not yet published; revisit after Axis disclosure. No exploitation or PoC seen.","cites":["https://help.axis.com/en-us/security-advisories","https://www.axis.com/ftp/pub_soft/PACS/A1610-B/latest/relnote.txt","https://techdocs.genetec.com/r/en-US/Security-Updates-for-Axis-Powered-by-Genetec/Resolved-vulnerabilities-in-Axis-Powered-by-Genetec-release-12.11.106.1"]}],"documents":[{"id":113491,"url":"https://help.axis.com/en-us/security-advisories","title":"Axis security advisories registry (Nov 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":113492,"url":"https://www.axis.com/ftp/pub_soft/PACS/A1610-B/latest/relnote.txt","title":"AXIS A1610 firmware 12.11.119.4 release note","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":113493,"url":"https://techdocs.genetec.com/r/en-US/Security-Updates-for-Axis-Powered-by-Genetec/Resolved-vulnerabilities-in-Axis-Powered-by-Genetec-release-12.11.106.1","title":"Axis Powered by Genetec 12.11.106.1 resolved vulnerabilities","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}