CVE-2026-63288 PUBLISHED

Assigner: Axis
Reserved: 16.07.2026 Published: 10.11.2026 Updated: 10.11.2026

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS Score: 8.3

Product Status

Vendor Axis Communications AB
Product AXIS A1210 - Secure Entry
Versions Default: unaffected
  • affected from 11.7.12.2 to 12.11.106.1 (excl.)
Vendor Axis Communications AB
Product AXIS A1601 - Secure Entry
Versions Default: unaffected
  • affected from 11.1.10.1 to 12.11.106.1 (excl.)
Vendor Axis Communications AB
Product AXIS A1610 - Secure Entry
Versions Default: unaffected
  • affected from 11.4.32.2 to 12.11.106.1 (excl.)
Vendor Axis Communications AB
Product AXIS A1710
Versions Default: unaffected
  • affected from 12.0.101.4 to 12.11.106.1 (excl.)
Vendor Axis Communications AB
Product AXIS A1810 - Secure Entry
Versions Default: unaffected
  • affected from 12.0.101.4 to 12.11.106.1 (excl.)

Credits

  • Alardiians finder

References

Problem Types

  • CWE-306: Missing Authentication for Critical Function CWE