EUVD-2026-91127

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regeneratelastturn. A remote caller can enumerate or obtain a sessionid and trigger regenerate on another user's session...

CVE-2026-51878

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regeneratelastturn. A remote caller can enumerate or obtain a sessionid and trigger regenerate on another user's session...

CVE-2026-51878

deeptutor version 1.4.0 is affected by an authorization bypass vulnerability in the TurnRuntimeManager.regenerate_last_turn function. The flaw stems from a user-controlled object identifier , which allows a remote caller to enumerate or obtain a session_id and trigger the regenerate action on a s...