---
id: "CVE-2026-63288"
page: "https://infrastack.ai/live/CVE-2026-63288"
kind: "vulnerability"
aliases: ["CVE-2026-63288"]
title: "AXIS OS Secure Entry: WebSocket request bypasses authentication to reach a separate API endpoint"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "AXIS OS Secure Entry", "fixed": ["12.11.106.1"], "affected": "< 12.11.106.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["access-control", "api", "axis", "axis-os", "iot", "other", "secure-entry", "websocket"]
not_affected_if: []
published_at: "2026-11-10T06:17:10+00:00"
first_seen_at: "2026-11-10T06:20:23+00:00"
updated_at: "2026-11-10T06:23:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63288", "first_seen_at": "2026-11-10T06:20:23+00:00"}, {"source": "analyst", "url": "https://help.axis.com/en-us/security-advisories", "first_seen_at": "2026-11-10T06:23:49+00:00", "cites": ["https://help.axis.com/en-us/security-advisories", "https://www.axis.com/ftp/pub_soft/PACS/A1610-B/latest/relnote.txt", "https://techdocs.genetec.com/r/en-US/Security-Updates-for-Axis-Powered-by-Genetec/Resolved-vulnerabilities-in-Axis-Powered-by-Genetec-release-12.11.106.1"]}]
exploit_sources: []
---

# AXIS OS Secure Entry: WebSocket request bypasses authentication to reach a separate API endpoint

Link for people: https://infrastack.ai/live/CVE-2026-63288 (this .md is for agents)

A WebSocket request sent to one API endpoint gives access to a different API endpoint without the intended authentication check. An attacker can reach functions they should not be able to call.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AXIS OS Secure Entry affected < 12.11.106.1 fixed 12.11.106.1

## How to check

Check the firmware version of Axis access-control devices (Secure Entry track, e.g. AXIS A1610, A1601) in the device web UI or AXIS Device Manager; versions older than 12.11.106.1 on the Secure Entry track should be treated as exposed. Affected lower bound not published yet; Axis will disclose details on 10 Nov 2026.

## Fix

Update AXIS OS Secure Entry firmware to 12.11.106.1 or later (Axis registry). Axis A1610 and A1601 firmware 12.11.119.4 (2026-09-29) lists this CVE as addressed.

## Timeline

- 2026-11-10T06:20:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63288
- 2026-11-10T06:23:49+00:00 analyst https://help.axis.com/en-us/security-advisories — Axis registry (primary) lists CVE-2026-63288, 8.3, fixed in AXIS OS Secure Entry 12.11.106.1; full details due 10 Nov 2026. A1610/A1601 12.11.119.4 release notes confirm addressed. Affected lower bound and exact mechanism not yet published; revisit after Axis disclosure. No exploitation or PoC seen.

## Documents

- [advisory] Axis security advisories registry (Nov 2026) https://help.axis.com/en-us/security-advisories
- [fix] AXIS A1610 firmware 12.11.119.4 release note https://www.axis.com/ftp/pub_soft/PACS/A1610-B/latest/relnote.txt
- [fix] Axis Powered by Genetec 12.11.106.1 resolved vulnerabilities https://techdocs.genetec.com/r/en-US/Security-Updates-for-Axis-Powered-by-Genetec/Resolved-vulnerabilities-in-Axis-Powered-by-Genetec-release-12.11.106.1

## From the sources

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_