{"affected":[{"defaultStatus":"unaffected","product":"AXIS A1210 - Secure Entry","source":"CNA: Axis","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"11.7.12.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1601 - Secure Entry","source":"CNA: Axis","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"11.1.10.1","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1610 - Secure Entry","source":"CNA: Axis","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"11.4.32.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1710","source":"CNA: Axis","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"12.0.101.4","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1810 - Secure Entry","source":"CNA: Axis","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"12.0.101.4","versionType":"semver"}]}],"cveId":"CVE-2026-63288","cwes":["CWE-306"],"description":"A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.3,"severity":"high","source":"CNA: Axis","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1794288726255,"publishedAt":1794288726255,"references":[{"source":"CNA: Axis","tags":[],"url":"https://www.axis.com/dam/public/fa/79/f5/cve-2026-63288pdf-en-US-561260.pdf"}],"remediation":[],"revision":"33d282d8aee7d6b8ad7bcba8d9c0cde9efcf7b4ee23642809e72203d991a0df4","sources":[{"modifiedAt":1794288726255,"name":"CNA: Axis","retrievedAt":1794290944857,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63288"}],"ssvc":null,"status":"published","title":"CVE-2026-63288","updatedAt":1794290944857}