WebSocket Connection Lacks Authentication

Summary

The real-time WebSocket endpoint only validated authentication on HTTP upgrade but not on WebSocket messages.

Proof of Concept

ws = new WebSocket('wss://target.com/ws');
ws.onopen = () => ws.send(JSON.stringify({
  action: 'getAdminData'
}));

Impact

Unauthorized access to real-time admin functionality.