{"type":"bundle","id":"bundle--4319c02f-f751-549d-8da2-3fb512fe2734","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--14d56c81-ccac-5622-a4ed-85d9f6541a46","created":"2026-09-20T19:03:30.589Z","modified":"2026-09-20T19:03:30.589Z","name":"Headroom WebSocket proxy can spend OpenAI keys for reachable browsers","description":"Headroom WebSocket proxy origin/CSWSH issues can spend OpenAI API keys for any reachable browser. Patch and rotate keys.","aliases":["CVE-2026-71416"],"first_seen":"2026-09-11T00:00:00.000Z","last_seen":"2026-09-11T12:00:00.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"NVD CVE-2026-71416","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71416"},{"source_name":"HOL Guard operator write-up","url":"https://hol.org/blog/cve-2026-71416-headroom-websocket-origin-cswsh-openai-key"},{"source_name":"CVE Record CVE-2026-71416","url":"https://www.cve.org/CVERecord?id=CVE-2026-71416"}]}]}