Bokeh server applications have Incomplete Origin Validation in WebSockets
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance.
Advisories for Pypi/Bokeh package
2026
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance.