CVE-2026-116679 Neko: Authorization bypass in legacy WebRTC input handling

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicithosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...

CVE-2026-116679 Neko: Authorization bypass in legacy WebRTC input handling

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicithosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...

CVE-2026-116679 Neko: Authorization bypass in legacy WebRTC input handling

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicithosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...

EUVD-2026-111245

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicithosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...

CVE-2026-116679

The self-hosted virtual browser Neko versions 3.0.0 through 3.1.4 are vulnerable to an authorization bypass in legacy WebRTC input handling. When legacy mode and session.implicit_hosting are enabled, the LegacyIsHost() function incorrectly evaluates host status. This allows an authenticated room ...