Taipy configures its socket.io server with a wildcard CORS origin and the credentials flag enabled, allowing any web page to establish a credentialed WebSocket connection to a running Taipy application. An attacker can invoke state‑changing callbacks or action callbacks without CSRF protection, enabling unauthorized modification of application state or execution of certain server‑side actions. The vulnerability reflects an insecure cross‑origin policy (CWE‑1385).

The vulnerability affects Avaiga’s Taipy framework, versions up to and including 4.1.1, whenever the default socket.io CORS settings are used. Deployments that have not upgraded to a version that corrects these settings are potentially exposed.

With a CVSS score of 9.3 the vulnerability is classified as critical. EPSS is not available, and the issue has not yet been listed in CISA’s KEV catalog, indicating no confirmed public exploitation. Attackers need only host a malicious web page; by directing victims to that page they can establish a WebSocket session and manipulate application state or invoke callbacks, without authentication or local privileges.