GHSA-5CP7-FP4J-WWCV Neko: Authorization bypass in legacy WebRTC input handling

Impact When legacy mode is enabled and session.implicithosting is enabled, the legacy WebRTC data channel incorrectly authorizes input events due to a logic error in LegacyIsHost. As a result, an authenticated room member may be able to send mouse and keyboard input through the legacy WebRTC...

Neko: Authorization bypass in legacy WebRTC input handling

Impact When legacy mode is enabled and session.implicithosting is enabled, the legacy WebRTC data channel incorrectly authorizes input events due to a logic error in LegacyIsHost. As a result, an authenticated room member may be able to send mouse and keyboard input through the legacy WebRTC...

CVE-2026-116679 Neko: Authorization bypass in legacy WebRTC input handling

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicithosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...

CVE-2026-116679 Neko: Authorization bypass in legacy WebRTC input handling

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicithosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...

CVE-2026-116679

The self-hosted virtual browser Neko versions 3.0.0 through 3.1.4 are vulnerable to an authorization bypass in legacy WebRTC input handling. When legacy mode and session.implicit_hosting are enabled, the LegacyIsHost() function incorrectly evaluates host status. This allows an authenticated room ...

CVE-2026-116679 Neko: Authorization bypass in legacy WebRTC input handling

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicithosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...

PT-2026-127181

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...