CVE-2025-54376 Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.

What is CVE-2025-54376?

CVE-2025-54376 is a high-severity missing authorization vulnerability in SpectoLabs hoverfly, published on 10 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time application logs (information disclosure) and/or gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. Version 1.12.0 contains a fix for the issue.

Weakness: CWE-532, CWE-287, CWE-200

Which versions are affected by CVE-2025-54376?

3 open source packages ship an affected version, including github.com/SpectoLabs/hoverfly. It affects 1 product.

Products include Hoverfly Hoverfly.

How do I fix CVE-2025-54376?

Upgrade github.com/SpectoLabs/hoverfly to 1.12.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-54376 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54376 exists.

Other vulnerabilities in SpectoLabs hoverfly

• CVE-2025-54123 Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation Critical 9.8
• CVE-2024-45388 Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`) High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jxmr-2h4q-rhxp, GO-2025-3945.