EUVD-2026-101601

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation...

CVE-2026-102682

The pipecat-ai Python framework (versions 0.0.98 to 1.6.0 ) contains a vulnerability where the built-in development runner exposes unauthenticated endpoints, including /start, /daily, and /daily-dialin-webhook. These endpoints allow unauthenticated callers to create bot sessions and Daily rooms ,...

CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

PT-2026-113941

Name of the Vulnerable Software and Affected Versions pipecat-ai versions 0.0.98 through 1.5.9 Description The built-in development runner of the pipecat-ai framework exposes unauthenticated endpoints, specifically '/start', '/daily', and '/daily-dialin-webhook', which allow the creation of bot...

Missing Authorization

Overview pipecat-ai is an An open source framework for voice and multimodal assistants Affected versions of this package are vulnerable to Missing Authorization via the telephony WebSocket /ws and plain WebSocket /ws-client endpoints, which accepts attacker-controlled handshake messages containin...

connexity (0.0.8.3), fixa-dev (0.0.4) +5 more potentially affected by CVE-2025-62373 via pipecat-ai (>=0.0.48, <=0.0.92)

pipecat-ai PYPI version =0.0.48, =0.1.0, =0.0.2, =0.1.1, =1.6.1.dev8325111910350515310, =1.7.1.dev260424103102100484 Source cves: CVE-2025-62373 Source advisory: MEND:CVE-2025-62373...