CVE-2026-116679

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-116679
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116679.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-116679
Aliases
Published
2026-10-27T17:33:35Z
Modified
2026-10-28T02:54:50Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Neko: Authorization bypass in legacy WebRTC input handling
Details

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116679.json"
}
References

Affected packages

Git / github.com/m1k1o/neko

Affected ranges

Type
GIT
Repo
https://github.com/m1k1o/neko
Events
Introduced
fe94c999c6aff927e0c28c31b4edacf503d18871
Fixed
395ca1a6f62b7b0e270e654d366a2d57b8042efd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.1.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "395ca1a6f62b7b0e270e654d366a2d57b8042efd"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v3.1.5",
            "range":  [
                {
                    "fixed":  "395ca1a6f62b7b0e270e654d366a2d57b8042efd"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v3.*
v3.0.0
v3.0.1
v3.0.10
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116679.json"