CVE-2026-107685

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on. The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected. This issue affects req_llm: from 1.9.0 before 1.29.0.

• CWE-295

• https://cna.erlef.org/cves/CVE-2026-107685.html
• https://github.com/agentjido/req_llm/commit/a389d718640ceb2d541a8f540ab954cbf5ef8313
• https://github.com/agentjido/req_llm/commit/c7264fc0217fbacfb5562234ff790b8e4462de76
• https://github.com/agentjido/req_llm/security/advisories/GHSA-6vww-5m28-f26v
• https://osv.dev/vulnerability/EEF-CVE-2026-107685

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107675FFmpeg through 9.0.2 contains a missing host key verificatio…5.9
• CVE-2026-107676FFmpeg through 9.0.2 contains an uninitialized memory disclo…3.3
• CVE-2026-107677FFmpeg through 9.0.2 contains a denial of service vulnerabil…4.7
• CVE-2026-107678FFmpeg through 9.0.2 contains a stack exhaustion vulnerabili…4.7
• CVE-2026-10768Missing Authorization vulnerability in Drupal LocalGov Workf…9.8
• CVE-2026-107682Adobe Experience Manager is affected by a DOM-based Cross-Si…5.4
• CVE-2026-107686The Gitea web handlers for adding and removing reactions on …4.3
• CVE-2026-10769Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-107692The War Thunder game client transmits its authentication bea…4.8
• CVE-2026-107694The Dokan: AI Powered WooCommerce Multivendor Marketplace So…2.7
• CVE-2026-107695FFmpeg before 8.1.3 contains an infinite loop vulnerability …6.5
• CVE-2026-107696FFmpeg through 9.0.2 contains an infinite loop vulnerability…6.5