Missing Origin Validation in WebSockets in Next.js - CVE-2025-48068

Vulnerability identifier: #VU109922

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-48068

CWE-ID: CWE-1385

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to missing origin validation on the WebSocket interface  if the project uses the App Router. When running next dev, a malicious website can open a WebSocket connection to localhost and access component source code.

Next.js
Event Processing
IBM Security QRadar Network Threat Analytics
QRadar Pre-Validation App
WatsonX BI Assistant
InfoSphere Optim Archive Viewer
IBM Cloud Pak for Security
QRadar Suite

Install updates from vendor's website.

Next.js - update to 15.2.2
Event Processing - update to 1.4.5
IBM Security QRadar Network Threat Analytics - update to 1.4.2
IBM Cloud Pak for Security - update to 1.11.9.0
QRadar Pre-Validation App - update to 2.0.2
WatsonX BI Assistant - update to 5.3
QRadar Suite - update to 1.11.9.0
InfoSphere Optim Archive Viewer - update to 11.7.0.14

• https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9r
• https://vercel.com/changelog/cve-2025-48068

• Missing WebSocket origin validation in Next.js
• Multiple vulnerabilities in IBM Security QRadar Network Threat Analytics
• Multiple vulnerabilities in IBM Event Processing
• Multiple vulnerabilities in IBM QRadar Pre-Validation App
• Multiple vulnerabilities in IBM WatsonX BI Assistant for CP4D
• Multiple vulnerabilities in IBM QRadar Suite
• IBM InfoSphere Optim Archive Viewer update for Next.js