GHSA-5cp7-fp4j-wwcvPublished
Neko: Authorization bypass in legacy WebRTC input handling
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-116679 · Microsoft / collected KEV context
cve-program · CVE-2026-116679
- https://github.com/m1k1o/neko/security/advisories/GHSA-5cp7-fp4j-wwcv
- https://github.com/m1k1o/neko/pull/675
- https://github.com/m1k1o/neko/commit/395ca1a6f62b7b0e270e654d366a2d57b8042efd
- https://github.com/m1k1o/neko/releases/tag/v3.1.5
euvd · EUVD-2026-111245
- https://github.com/m1k1o/neko/security/advisories/GHSA-5cp7-fp4j-wwcv
- https://github.com/m1k1o/neko/pull/675
- https://github.com/m1k1o/neko/commit/395ca1a6f62b7b0e270e654d366a2d57b8042efd
- https://github.com/m1k1o/neko/releases/tag/v3.1.5
nvd · CVE-2026-116679
- https://github.com/m1k1o/neko/commit/395ca1a6f62b7b0e270e654d366a2d57b8042efd
- https://github.com/m1k1o/neko/pull/675
- https://github.com/m1k1o/neko/releases/tag/v3.1.5
- https://github.com/m1k1o/neko/security/advisories/GHSA-5cp7-fp4j-wwcv
osv · GHSA-5cp7-fp4j-wwcv
- https://github.com/m1k1o/neko/security/advisories/GHSA-5cp7-fp4j-wwcv
- https://nvd.nist.gov/vuln/detail/CVE-2026-116679
- https://github.com/m1k1o/neko/pull/675
- https://github.com/m1k1o/neko/commit/395ca1a6f62b7b0e270e654d366a2d57b8042efd
- https://github.com/m1k1o/neko
- https://github.com/m1k1o/neko/releases/tag/v3.1.5
Related operational evidence
Explicit CVE identifiers- Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input becau… · Advisory content revised · 29 Oct 2026
- Neko: Authorization bypass in legacy WebRTC input handling · Newly collected advisory · 27 Oct 2026
- Neko: Authorization bypass in legacy WebRTC input handling · Newly collected advisory · 27 Oct 2026