https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8 Echo's Proxy middleware opened a raw tunnel as soon as a client asked for a WebSocket upgrade, before checking whether the upstream accepted it. If the upstream answered with an ordinary HTTP response and kept the connection alive, later HTTP requests on that connection went straight to the upstream without passing through Echo's router or route-specific middleware, which can bypass authentication or authorization enforced only at Echo's routes. It needs an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. It affects the v4 and v5 release lines; upgrade to v4.16.1 or v5.4.1. GitHub rates it critical; no CVE id has been assigned yet. en Fri, 23 Oct 2026 00:00:00 GMT https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8 https://pwn.watch/i/labstack-echo-proxy-websocket-auth-bypass-ghsa-cxf3-9h37-7rr8#2026-10-23-5e8258d3 Fri, 23 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8">Source</a></p>