MeshCentral 1.1.21 contains an unconditional early return in CheckWebServerOriginName() that bypasses the origin validation for WebSocket requests when the server is using a self‑signed certificate. An unauthenticated attacker can open a cross‑origin WebSocket connection to any of the twelve exposed endpoints, send specially crafted action commands, capture the sessionKey that signs the session cookie, forge session tokens of arbitrary users, and consequently gain full administrative control over every device managed by the MeshCentral instance. CWE‑346 indicates this flaw is an authentication bypass via missing or incorrect verification of the origin header.

The vulnerability is present in MeshCentral version 1.1.21; all instances deployed with that version and a self‑signed certificate are affected.

The CVSS score of 8.6 classifies this flaw as High. The EPSS score of <1% indicates a very low but nonzero probability of exploitation, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw without valid credentials by simply hosting a malicious page that initiates a WebSocket connection to the target server, making the exploitation vector web‑based and easy to automate.