CVE-2026-107685

The agentjido req_llm library (versions 1.9.0 before 1.29.0 ) contains an Improper Certificate Validation vulnerability in its WebSocket streaming client. The ReqLLM.Streaming.WebSocketSession.Client.start/3 function initiates connections using WebSockex without providing TLS options; because Web...

EEF-CVE-2026-107685 WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers

Summary Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido reqllm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust...

EUVD-2026-108709

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido reqllm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust...