CVE-2022-42975: Phoenixframework Phoenix

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

Affected products

• Phoenixframework Phoenix: before 1.6.14 (fixed in 1.6.14)

Published 2022-10-17. Last modified 2026-06-17.