TI-2026-81487 Aliases CVE-2026-116679 GHSA-5cp7-fp4j-wwcv

Authorization bypass in Neko legacy WebRTC input handling

LOW 24CWE-863Published 2026-10-27 · Updated 2026-10-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Neko from 3.0.0 before 3.1.5 and the Go package github.com/m1k1o/neko/server from 0.0.0-20250401220545-fe94c999c6af before 0.0.0-20260805142851-395ca1a6f62b are affected. Deployments with legacy mode and session.implicit_hosting enabled wrongly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly (CWE-863). An authenticated room member with a WebRTC connection can send mouse and keyboard events while controls are locked or the member is otherwise unauthorized.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00311 24th percentileScored 2026-11-07

Fix Fixed neko (m1k1o): 3.1.5github.com/m1k1o/neko/server (Go): 0.0.0-20260805142851-395ca1a6f62b

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
m1k1o	neko	3.0.0 to before 3.1.5	3.1.5	Patch available	CNA
—	github.com/m1k1o/neko/server (Go)	0.0.0-20250401220545-fe94c999c6af to before 0.0.0-20260805142851-395ca1a6f62b	0.0.0-20260805142851-395ca1a6f62b	Patch available	GHSA-5cp7-fp4j-wwcv

neko Vendorm1k1o Affected 3.0.0 to before 3.1.5 Fixed in 3.1.5 Patch available CNA
github.com/m1k1o/neko/server (Go) Vendor— Affected 0.0.0-20250401220545-fe94c999c6af to before 0.0.0-20260805142851-395ca1a6f62b Fixed in 0.0.0-20260805142851-395ca1a6f62b Patch available GHSA-5cp7-fp4j-wwcv

Remediation

Upgrade Neko to version 3.1.5. Upgrade the Go package github.com/m1k1o/neko/server to 0.0.0-20260805142851-395ca1a6f62b.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA neko (m1k1o) Fixed in 3.1.5
Fix · GHSA-5cp7-fp4j-wwcv github.com/m1k1o/neko/server (Go) Fixed in 0.0.0-20260805142851-395ca1a6f62b Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-27 Threatist record created from CVE-2026-116679
2026-10-27 Alias added: GHSA-5cp7-fp4j-wwcv
2026-10-28 CISA SSVC decision points changed
2026-10-28 Priority changed: MEDIUM → LOW
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-116679

Other 5

TI-2022-07679 Insufficient file checks in m1k1o/blog CVSS 3.1HIGH 8.8
TI-2026-28371 Neko has Self-service Privilege Escalation for Authenticated Users CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences