CVE-2020-15133

In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Connection#start_tls` method in EventMachine to implement the TLS handshake whenever a `wss:` URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any `wss:` connection made using this library is vulnerable to a man-in-the-middle attack, since it does not confirm the identity of the server it is connected to. For further background information on this issue, please see the referenced GitHub Advisory. Upgrading `faye-websocket` to v0.11.0 is recommended.

• CWE-295
• CWE-295

• https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye/Exploit, Third Party Advisory
• https://github.com/faye/faye-websocket-ruby/security/advisories/GHSA-2v5c-755p-p4gvExploit, Third Party Advisory
• https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye/Exploit, Third Party Advisory
• https://github.com/faye/faye-websocket-ruby/security/advisories/GHSA-2v5c-755p-p4gvExploit, Third Party Advisory

Published

Jul 31, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15128In OctoberCMS before version 1.0.468, encrypted cookie value…6.3
• CVE-2020-15129In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, the…4.7
• CVE-2020-1513An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15130In SLPJS (npm package slpjs) before version 0.27.4, there is…7.5
• CVE-2020-15131In SLP Validate (npm package slp-validate) before version 1.…7.5
• CVE-2020-15132In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the …5.3
• CVE-2020-15134Faye before version 1.4.0, there is a lack of certification …8.7
• CVE-2020-15135save-server (npm package) before version 1.05 is affected by…7.6
• CVE-2020-15136In ectd before versions 3.4.10 and 3.3.23, gateway TLS authe…6.5
• CVE-2020-15137All versions of HoRNDIS are affected by an integer overflow …5.9
• CVE-2020-15138Prism is vulnerable to Cross-Site Scripting. The easing prev…7.5
• CVE-2020-15139In MyBB before version 1.8.24, the custom MyCode (BBCode) fo…6.1