The vulnerability arises when the UFO framework reuses a single UFOWebSocketHandler instance across multiple authenticated WebSocket connections. Because the handler stores protocol objects in mutable fields, a new connection overwrites the previous client’s state. Subsequent message handling routes responses through these shared fields, causing responses that belong to one authenticated client to be delivered to another. This results in cross‑client response hijacking, exposing sensitive data or disrupting user sessions.

Microsoft UFO, version 3.0.1-4-ge2626659, and any subsequent releases built from the same 3.x branch that retain the shared handler implementation. The issue is specific to the UFOWebSocketHandler when used in authenticated contexts.

The CVSS score of 6.3 indicates moderate risk. There is no EPSS data and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not currently widely exploited. Based on the description, the attack vector involves a legitimate authenticated client that can establish a WebSocket connection to the targeted service. Once connected, the attacker can trigger message exchanges and receive data intended for other authenticated clients, thereby leaking information between users.