Vulnerabilities

TI-2025-34185 CVE-2025-54376 · GHSA-jxmr-2h4q-rhxp

Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.

HIGH 73

Hoverfly is an open source API simulation tool.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.00711 Published 2025-09-10 Fixed in 1.12.0 CWE-200

TI-2025-33966 CVE-2025-54123 · GHSA-r4h8-hfp2-ggmf

HIGH 82

Hoverfly is an open source API simulation tool.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10908 Published 2025-09-10 No fix listed CWE-20

TI-2024-30437 CVE-2024-45388 · GHSA-6xx4-x46f-f897

HIGH 72

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.55574 Published 2024-09-02 Fixed in 1.10.3 CWE-200