EUVD-2026-91127

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regeneratelastturn. A remote caller can enumerate or obtain a sessionid and trigger regenerate on another user's session...

CVE-2026-51878

The software Deeptutor version 1.4.0 is vulnerable to an authorization bypass within the TurnRuntimeManager.regenerate_last_turn function. This flaw allows a remote caller to use a user-controlled object identifier to enumerate or obtain a session_id , subsequently enabling them to trigger the re...