WHartTest up through version 2.8.1 allows an unauthenticated attacker to connect to the WebSocket endpoints /ws/ui/web/ and /ws/ui/actuator/. The UiAutomationConsumer accepts every connection without verifying authentication, a missing authentication weakness (CWE‑306). Attackers can register a custom actuator id, intercept other users’ test‑case payloads, receive broadcast step results, and inject false results or screen frames into victim sessions. Such manipulation can lead to data leakage, incorrect test outcomes and may compromise the integrity of the UI‑automation workflow.

The vulnerability affects the MGdaasLab WHartTest application, specifically releases up through and including version 2.8.1. No other product versions are listed as affected.

The CVSS score of 6.9 indicates a moderate severity level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is any remote actor with network reachability to the application who can establish a WebSocket handshake to the exposed endpoints. Because authentication checks are omitted, exploitation requires only network access and the ability to open a WebSocket connection, making the vulnerability relatively easy to exploit if the endpoints are publicly reachable.