What is a WebSocket Session Leak in Phishing?

A WebSocket session leak in the context of phishing and social engineering is a vulnerability where a WebSocket session, which should be secure and privately established between a client and server, is exposed. This leak allows attackers to intercept or hijack the session, gaining unauthorized access to the application or user account.

“A WebSocket session leak is the unintended exposure or interception of a WebSocket communication session, which attackers can exploit to hijack and manipulate session data in phishing and social engineering attacks.”

WebSocket session leaks are crucial in phishing because they enable attackers to execute advanced techniques like session hijacking, which can lead to unauthorized access and privilege escalation. Social engineers may exploit these leaks to establish persistent control over a victim’s session, allowing them to manipulate data and perform actions on behalf of the user without detection.

In phishing engagements, a WebSocket session leak can be encountered when a target accesses a compromised service or application. Attackers may use specially crafted phishing emails or fake landing pages designed to mimic legitimate interfaces. When a user interacts with these interfaces, any vulnerabilities in WebSocket handling can be exploited to leak session details to the attacker.

In Practice

A real-world example of a WebSocket session leak exploitation can be seen in the Zammad vulnerability (CVE-2026-102489). In this case, the vulnerability allowed attackers to intercept WebSocket communication by exploiting an improperly configured server. Once gained, an attacker could hijack user sessions to execute arbitrary commands within the application’s context.


Subject: Required Account Verification



Dear User,



We have detected unusual activity in your account. Please click on the link below to verify your session.



<a href="http://account-verification.secure.com">Verify Now</a>

In this phishing email example, upon clicking the link, the target lands on a webpage mimicking the legitimate login interface. However, this interface contains an embedded JavaScript payload that establishes a WebSocket connection to the attacker’s server. If the page’s WebSocket handling is flawed, the session data can be captured and used to hijack the existing session or manipulate the application state.

Another tactic involves social engineering techniques where attackers pose as technical support personnel and guide the user through steps that inadvertently expose a WebSocket session ID. This approach relies heavily on trust manipulation and a convincing pretext.

Related Terms

Understanding WebSocket session leaks requires a grasp of related terms such as session hijacking, cross-site WebSocket hijacking, and Cross-Site Request Forgery (CSRF). Each of these plays a role in understanding the complexity of session-based attacks in the context of phishing and social engineering.