Taipy Web App Socket.IO CORS Misconfiguration

Taipy, a web application framework, misconfigures its Socket.IO server with wildcard CORS origin and credential flag enabled.

This allows any web page to establish credentialed WebSocket connections to victim applications, bypassing CSRF protection.

Impact: Attackers can invoke state variable modifications and action callbacks without user interaction.