The flaw allows attackers who can reach the Cline Kanban server’s WebSocket endpoint to hijack connections by sending crafted frames. Because the server does not validate the origin header, malicious actors can impersonate legitimate clients, potentially accessing or altering Kanban data, as indicated by the cross‑origin WebSocket hijacking weakness. The associated CWE‑1385 points to missing origin checks, while CWE‑306 highlights potential authentication bypass issues. No evidence is provided of remote code execution or direct data exfiltration from this flaw.

All Cline products that include the Kanban server component – the SDK, IDE extension, and CLI assistant – running version 2.13.0 or earlier are affected.

The CVSS score of 9.6 signals a critical risk. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation is unclear, but the absence of origin validation means any client that can reach the WebSocket endpoint can exploit the flaw without authentication. This makes it potentially useful for targeted attacks against users of the affected Cline versions.