CVE-2025-66286 PUBLISHED

Webkitgtk: authorization bypass through webpage::send-request signal handler

Assigner: redhat
Reserved: 26.11.2025 Published: 23.04.2026 Updated: 23.04.2026

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS Score: 4.7

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected

Credits

  • Red Hat would like to thank Albrecht Dreß for reporting this issue.

References

Problem Types

  • Authorization Bypass Through User-Controlled Key CWE