Technical impact
Headroom compresses data before it reaches a large language model. Prior to version 0.35.0, the WebSocket server does not validate the Origin header of incoming client connections, which allows a malicious WebSocket client to forward requests to the upstream server without authentication. The result is that an attacker can issue arbitrary LLM requests using the victim’s stored OpenAI API key, potentially incurring flaw reflects a lack of origin validation and improper authentication (CWE-1385, CWE-287).
Affected Systems
The vulnerability affects the Headroom product from Headroom Labs, specifically any deployment running a version prior to 0.35.0. Victim systems that expose the Headroom WebSocket endpoint to browsers (including headless browsers) and that have the OPENAI_API_KEY environment variable available are at risk.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity. EPSS information is not available, so the precise exploitation likelihood cannot be quantified, but the vulnerability is publicly documented and advisory links show that the flaw has been fixed in 0.35.0. The attack vector requires a malicious WebSocket client executed in a browser that can reach the Headroom proxy; the attacker need not have elevated privileges on the server but requires network access to the WebSocket endpoint. The repository advisory notes that this can be exploited by headless browsers such as Lightpanda. Because the flaw allows unauthenticated requests to the LLM, the impact is significant for confidentiality, integrity, and potential financial loss if the API key is compromised.
Github GHSA