CVE-2026-43910High· 8.2▾ Twilightjava-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.4%
When directConnect(true) is enabled, appium/java-client unconditionally
accepts directConnectHost, directConnectPort, and directConnectPath
from the server's NEW_SESSION response and silently redirects all subsequent
session traffic to the attacker-specified endpoint — with no allowlist,
no host validation, and no user notification.
AppiumCommandExecutor.java (line 196–219): setDirectConnect() builds
a new URL from server-supplied fields and calls overrideServerUrl(newUrl)
without validating host/IP.DirectConnect.java: getUrl() constructs protocol://host:port/path
with no allowlist.Only the protocol is validated (must equal "https"). The destination host and port are never checked against any allowlist or denylist.
A rogue server injecting directConnectHost=127.0.0.1:4443 causes the
client to silently redirect all post-session commands:
[bootstrap] POST /wd/hub/session [bootstrap] Injecting directConnect -> https://127.0.0.1:4443/wd/hub [redirect-target] HIT #1: GET /wd/hub/session/poc-session-001/source [redirect-target] HIT #2: DELETE /wd/hub/session/poc-session-001
Original source code unmodified — confirmed via git diff HEAD (empty).
Screenshot 1 — Rogue server capturing redirected traffic:
<img width="887" height="146" alt="1" src="https://github.com/user-attachments/assets/cc28002c-ea20-4ac8-8336-cec632e3c842" />Screenshot 2 — Java client processing response from attacker host:
<img width="788" height="130" alt="2" src="https://github.com/user-attachments/assets/222cbab0-0d53-45b2-847d-6aa4e3b79370" />Add allowlist validation before overrideServerUrl() is called, and/or
block RFC-1918/loopback/link-local destinations by default.
io.appium:java-client >= 8.2.1, <= 10.1.0Upgrade to a patched release:
io.appium:java-client 10.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67077Medium· 4.2HCL BigFix AEX is affected by multiple security vulnerabilities.
CVE-2026-93294Medium· 6.3A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy)
CVE-2026-102255Critical· 10.0A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path
CVE-2026-101907High· 7.0Axios is a promise-based HTTP client for the browser and Node.js
CVE-2026-45723Low· 2.7Omni manages Kubernetes on bare metal, virtual machines, or in a cloud
CVE-2026-61793Medium· 6.9Nuxt OG Image generates OG Images with Vue templates in Nuxt