---
id: CVE-2026-116679
title: 'Neko: Authorization bypass in legacy WebRTC input handling'
summary: >-
  Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC.
  From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and
  session.implicit_hosting enabled incorrectly authorize legacy WebRTC
  data-channel input be…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-863
vendor: m1k1o
product: neko
affected:
  - 'neko >= 3.0.0, < 3.1.5'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T14:34:30.608545Z'
published: '2026-10-27'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:13:59.494Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116679'
references:
  - url: 'https://github.com/m1k1o/neko/security/advisories/GHSA-5cp7-fp4j-wwcv'
    label: 'https://github.com/m1k1o/neko/security/advisories/GHSA-5cp7-fp4j-wwcv'
  - url: 'https://github.com/m1k1o/neko/pull/675'
    label: 'https://github.com/m1k1o/neko/pull/675'
  - url: >-
      https://github.com/m1k1o/neko/commit/395ca1a6f62b7b0e270e654d366a2d57b8042efd
    label: >-
      https://github.com/m1k1o/neko/commit/395ca1a6f62b7b0e270e654d366a2d57b8042efd
  - url: 'https://github.com/m1k1o/neko/releases/tag/v3.1.5'
    label: 'https://github.com/m1k1o/neko/releases/tag/v3.1.5'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-116679'
  - url: 'https://github.com/advisories/GHSA-5cp7-fp4j-wwcv'
tags:
  - cve.org
  - ghsa
  - go
epss: 0.00311
epssPercentile: 0.23935
aliases:
  - GHSA-5cp7-fp4j-wwcv
ecosystem: go
patched:
  - github.com/m1k1o/neko/server 0.0.0-20260805142851-395ca1a6f62b
ingestedAt: '2026-10-27T17:54:31.827Z'
---

## Overview

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5.

## Affected

- `neko >= 3.0.0, < 3.1.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-116679)

Affected packages:

- `github.com/m1k1o/neko/server >= 0.0.0-20250401220545-fe94c999c6af, < 0.0.0-20260805142851-395ca1a6f62b`

Patched in:

- `github.com/m1k1o/neko/server 0.0.0-20260805142851-395ca1a6f62b`

Source: https://github.com/advisories/GHSA-5cp7-fp4j-wwcv