CVE-2026-116679

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5.

• CWE-863

• https://github.com/m1k1o/neko/commit/395ca1a6f62b7b0e270e654d366a2d57b8042efd
• https://github.com/m1k1o/neko/pull/675
• https://github.com/m1k1o/neko/releases/tag/v3.1.5
• https://github.com/m1k1o/neko/security/advisories/GHSA-5cp7-fp4j-wwcv

Published

Oct 27, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116673systeminformation is a System and OS information library for…3.3
• CVE-2026-116674systeminformation is a System and OS information library for…6.5
• CVE-2026-116675TinyMCE is an open source rich text editor. From 7.9.3 until…8.5
• CVE-2026-116676Atlantis is a self-hosted golang application that listens fo…8.8
• CVE-2026-116677OpenWISP Controller is a network and WiFi controller for pro…5.3
• CVE-2026-116678Vaultwarden is a Bitwarden-compatible server written in Rust…5.8
• CVE-2026-11668Uninitialized Use in Codecs in Google Chrome on Linux, Chrom…4.3
• CVE-2026-116680HomeBox is a home inventory and organization system. Prior t…6.4
• CVE-2026-116682FileBrowser Quantum is a free, self-hosted, web-based file m…8.6
• CVE-2026-116683CTFer.io's CTFd Terraform Provider manages CTFd resources as…7.1
• CVE-2026-116684The Model Context Protocol Python SDK is the official Python…6.8
• CVE-2026-116685The Model Context Protocol Python SDK is the official Python…5.9