CVE-2026-67448

## Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accepts every origin. Confirmed at HEAD 408b30d. Affects 1.29.0 through 1.30.5. ## The defect Two halves that were each correct in isolation. server/websockets/client.go accepts any origin and delegates the check elsewhere: ```go var upgrader = websocket.Upgrader{ // line 33 ... CheckOrigin: func(_ *http.Request) bool { // line 37 // origin is checked via server.go's CORS settings return true // line 39 }, } ``` server/server.go performs that check but keys it on the RAW request target: ```go if strings.HasPrefix(r.RequestURI, config.Webroot+"api/") || htmlPreviewRouteRe.MatchString(r.RequestURI) { // line 320 if allowed := corsOriginAccessControl(r); !allowed { http.Error(w, "Blocked due to CORS violation", http.StatusForbidden) return } ``` r.RequestURI is the untouched wire target; Go's ServeMux routes on the percent-DECODED path. So for /%61pi/events: `strings.HasPrefix("/%61pi/events", "/api/")` is FALSE (origin check skipped), ServeMux decodes %61 to "a" and routes to /api/events, and the upgrader's CheckOrigin returns true. Measured, default config, no auth: /api/events with `Origin: https://evil.example` returns 403; /%61pi/events with the same Origin returns 101 Switching Protocols and begins streaming. With a message delivered over SMTP while the cross-origin socket was open, the attacker origin received the ID, Message-Id, From, To, Cc, Bcc, Subject ("SECRET password reset token abc123"), size, tags, and body Snippet, live. WebSockets are not subject to CORS response-header enforcement, so the absent Access-Control-Allow-Origin header p