CVE-2026-43910 affects Appium Java Client versions 8.2.1 through 10.1.1, where enabling directConnect(true) allows a rogue or compromised Appium server to redirect all session traffic to an arbitrary destination. The vulnerability exists in AppiumCommandExecutor.setDirectConnect(), which reads host, port, and path fields from the server's NEW_SESSION response without validating the host against an allowlist or performing IP validation. This insufficient validation enables full interception of WebDriver session traffic. Additionally, the flaw can be exploited as a Server-Side Request Forgery (SSRF) pivot to reach internal hosts, including cloud metadata services (IMDS), potentially leading to credential theft. The vulnerability is classified as high severity due to the risk of session interception and cloud credential exfiltration. A fix has been released in version 10.1.1 of the Appium Java Client. Users are strongly advised to upgrade immediately to mitigate the risk.