CVE-2026-54695

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54695

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54695.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54695

Aliases

Published

2026-07-09T18:52:33Z

Modified

2026-10-28T02:30:49Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H CVSS Calculator

Summary

Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Details

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake in src/pipecat/runner/utils.py, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo. This issue is fixed in version 1.4.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54695.json"
}

References

Affected packages

Git / github.com/pipecat-ai/pipecat

Affected ranges

Type

GIT

Repo

https://github.com/pipecat-ai/pipecat

Events

Introduced

Fixed

3a69d3f79cedc8daab2a57e44a17d34a18f1c096

Fixed

3032da53434c5ef01d368654b3551cf21c50dec9

Fixed

88440676996e5e548e1aecea5d565e1c48ccf6fa

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:pipecat:pipecat:*:*:*:*:*:python:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.4.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "3032da53434c5ef01d368654b3551cf21c50dec9"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "88440676996e5e548e1aecea5d565e1c48ccf6fa"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.4.0",
            "range": [
                {
                    "fixed": "3a69d3f79cedc8daab2a57e44a17d34a18f1c096"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.0.10

v0.0.100

v0.0.101

v0.0.102

v0.0.103

v0.0.104

v0.0.105

v0.0.106

v0.0.107

v0.0.108

v0.0.11

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.16

v0.0.17

v0.0.18

v0.0.19

v0.0.2

v0.0.20

v0.0.21

v0.0.22

v0.0.23

v0.0.24

v0.0.25

v0.0.26

v0.0.27

v0.0.28

v0.0.29

v0.0.3

v0.0.30

v0.0.31

v0.0.32

v0.0.33

v0.0.34

v0.0.35

v0.0.36

v0.0.37

v0.0.38

v0.0.39

v0.0.4

v0.0.40

v0.0.41

v0.0.42

v0.0.43

v0.0.44

v0.0.45

v0.0.46

v0.0.47

v0.0.48

v0.0.49

v0.0.5

v0.0.50

v0.0.52

v0.0.53

v0.0.54

v0.0.55

v0.0.56

v0.0.57

v0.0.58

v0.0.59

v0.0.6

v0.0.60

v0.0.61

v0.0.62

v0.0.63

v0.0.64

v0.0.65

v0.0.66

v0.0.67

v0.0.68

v0.0.69

v0.0.7

v0.0.70

v0.0.71

v0.0.72

v0.0.73

v0.0.74

v0.0.75

v0.0.76

v0.0.77

v0.0.78

v0.0.79

v0.0.8

v0.0.80

v0.0.81

v0.0.82

v0.0.83

v0.0.84

v0.0.85

v0.0.86

v0.0.87

v0.0.88

v0.0.89

v0.0.9

v0.0.90

v0.0.91

v0.0.92

v0.0.93

v0.0.94

v0.0.95

v0.0.96

v0.0.97

v0.0.98

v0.0.99

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.2.1

v1.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54695.json"