Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

SummaryAn authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the session...

Predictable WebSocket Session IDs

org.springframework, spring-websocket is vulnerable to Predictable WebSocket Session IDs. The vulnerability is due to WebSocket session IDs in the spring-websocket module not being cryptographically unpredictable, which allows an attacker to potentially predict valid session IDs and gain...

Security Bulletin: Unauthenticated Session History Access via Public Flow Execution

Summary A session ID namespace bypass vulnerability existed in Langflow OSS' POST /api/v1/buildpublictmp/flowid/flow endpoint that allowed unauthenticated attackers to access chat history from other users' sessions. The endpoint accepted an inputs.session parameter that could override the session...

CVE-2026-67431

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that...

CVE-2026-66745

Artica Proxy before 4.50.000000 Service Pack 7 fixed in hotfix 20260724-02 contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controll...

CVE-2026-66745

Artica Proxy 4.50 (before SP7) is affected by a session-fixation flaw that allows an unauthenticated attacker to hijack an admin session by pre-setting a known PHPSESSID on a victim’s browser prior to login through fw.login.php, gaining a fully authenticated admin session on port 9000. Affected v...

CVE-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

Summary Cloudreve WOPI access tokens are generated as ., but the WOPI middleware validates only the session id prefix and never compares the supplied token to the stored token. In addition, a WOPI viewer session does not store or enforce the requested viewer action. A session created for a view o...

GHSA-J657-M4C4-24JQ Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Summary The terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...

User Impersonation

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to User Impersonation via the wsterminal process. An attacker can gain unauthorized access to another user's terminal session by injecting crafted values into the sessionid parameter, causing the backend to...

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Summary The terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the sessio...

PYSEC-2026-3482 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...

CVE-2026-13577

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577 Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577 Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

PT-2026-60967

Name of the Vulnerable Software and Affected Versions urwid affected versions not specified Description The web display backend in urwid/display/web.py uses Python's Mersenne Twister PRNG to generate web session identifiers urwid id within the Screen.start function. Because this PRNG is not...

Linux Distros Unpatched Vulnerability : CVE-2026-9323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that...

CVE-2026-52869

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamablehttpmanager.StreamableHTTPSessionManager route requests to existing...

CVE-2026-52869

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamablehttpmanager.StreamableHTTPSessionManager route requests to existing...