VULNERABILITY INTELLIGENCE
CVE-2026-56104
CVSS score9.1 CRITICAL
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-06-22
Last modified2026-10-08
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Description
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.
Weakness classification
- CWE-862: Missing Authorization