CVE-2026-54695

CVE-2026-54695 - Pipecat Telephony WebSocket /ws Unauthenticated Call-Control Abuse Pipecat prior to v1.4.0 registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication. An attacker can send a crafted handshake containing a caller-supplied callSid, whic...

CVE-2026-54695

creationtimestamp| type| source ---|---|--- 2026-06-17 14:39:37+00:00| published-proof-of-concept| https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-j8cv-x86q-rj85 2026-07-09 20:26:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqahs45ntd2x...