CVE-2026-54695

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake in src/pipecat/runner/utils.py, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo. This issue is fixed in version 1.4.0.

• CWE-862

• https://github.com/pipecat-ai/pipecat/commit/3032da53434c5ef01d368654b3551cf21c50dec9Patch
• https://github.com/pipecat-ai/pipecat/commit/88440676996e5e548e1aecea5d565e1c48ccf6faPatch
• https://github.com/pipecat-ai/pipecat/pull/4660Issue Tracking, Patch
• https://github.com/pipecat-ai/pipecat/releases/tag/v1.4.0Issue Tracking, Patch
• https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-j8cv-x86q-rj85Exploit, Mitigation, Vendor Advisory
• https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-j8cv-x86q-rj85Exploit, Mitigation, Vendor Advisory

Published

Jul 9, 2026

Last Modified

Jul 13, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54685FileBrowser Quantum is a free, self-hosted, web-based file m…5.3
• CVE-2026-54686Warp is an agentic development environment. From 0.2021.04.2…4.3
• CVE-2026-5469A weakness has been identified in Casdoor 2.356.0. This vuln…7.2
• CVE-2026-54690datamodel-code-generator generates Pydantic v2 models, datac…8.2
• CVE-2026-54691datamodel-code-generator generates Python data models from s…8.2
• CVE-2026-54693ZITADEL is an open source identity management platform. From…8.2
• CVE-2026-54696Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 …3.7
• CVE-2026-54698Hasura is an open-source product that provides users GraphQL…6
• CVE-2026-54699Warp is an agentic development environment. From 0.2024.03.1…7.7
• CVE-2026-5470A security vulnerability has been detected in mixelpixx Goog…6.3
• CVE-2026-54704OpenTelemetry Java Instrumentation provides OpenTelemetry au…6.5
• CVE-2026-54705MathLive provides web components for math display and input.…6.3