{"id":"CVE-2026-56104","title":"Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without owner…","summary":"Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without owner…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":["CWE-862"],"vendor":"Chainlit","product":"chainlit","affected":["chainlit < 2.10.1"],"patched":["chainlit 2.10.1"],"published":"2026-06-22","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:17:21.397","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56104","references":[{"url":"https://github.com/Chainlit/chainlit/commit/5effb664f1e0af4a4f0a42fe63ea979676039a7f","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Chainlit/chainlit/pull/2857","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Chainlit/chainlit/releases/tag/2.10.1","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/chainlit-session-hijacking-via-websocket-session-restoration","label":"disclosure@vulncheck.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56104"},{"url":"https://github.com/Chainlit/chainlit"},{"url":"https://pypi.org/project/chainlit"},{"url":"https://github.com/advisories/GHSA-c39v-8hrw-h448"}],"tags":["nvd","cve.org","osv","pip","ghsa"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-22T16:06:42.802313Z"},"epss":0.00417,"epssPercentile":0.35774,"aliases":["GHSA-c39v-8hrw-h448","PYSEC-2026-4028"],"ecosystem":"pip","scores":{"nvd":8.2,"osv":7.4},"ingestedAt":"2026-09-21T22:54:37.976Z","slug":"CVE-2026-56104","body":"## Overview\n\nChainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-56104)\n\nAffected packages:\n\n- `chainlit < 2.10.1`\n\nPatched in:\n\n- `chainlit 2.10.1`\n\nSource: https://osv.dev/vulnerability/GHSA-c39v-8hrw-h448","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":218122,"id":"CVE-2026-56104","ts":1791478409069,"field":"cvss","old":"7.4","new":"8.2"},{"seq":208906,"id":"CVE-2026-56104","ts":1790061351639,"field":"severity","old":"critical","new":"high"}]}