A local installation of the email testing tool Mailpit is vulnerable to Cross‑Site WebSocket Hijacking because the server accepts connections from any origin. This flaw allows a malicious website to force a developer to open a WebSocket to the local Mailpit instance; the attacker can then read every email, header, and statistic streamed by the server in real time. No authentication is required, and the data is not obfuscated, so attackers obtain full confidentiality of all traffic sent through the server.

The vulnerability affects the axllent Mailpit product. Versions earlier than 1.28.2 are impacted, including any build that incorporates the pre‑1.28.2 WebSocket server configuration that does not validate the Origin header. Newer releases from 1.28.2 onward have the fix.

CVSS scoring of 6.5 indicates a medium severity; the EPSS score of <1% implies a low likelihood of exploitation in the wild. The flaw is not listed as a known exploited vulnerability in the KEV catalog. Attackers can exploit the issue by hosting a malicious page that a developer inadvertently visits while running Mailpit locally, establishing an unauthenticated WebSocket connection and harvesting sensitive data. The attack requires no prior access and leverages the lack of Origin validation on the server.