EUVD-2026-38285
GHSA-c39v-8hrw-h448
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Chainlit instance
-
DeliveryObtain victim sessionId via leak or interception
-
ExploitOpen WebSocket connection
-
ExecutionInvoke restore_existing_session with sessionId
-
PersistInherit victim's authenticated identity
-
ImpactInvoke privileged tools and exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must possess a valid, currently-active sessionId belonging to an authenticated Chainlit user and must be able to reach the Chainlit WebSocket endpoint over the network. Exploitation specifically requires invoking the restore_existing_session WebSocket path on a Chainlit instance running a version earlier than 2.10.1; no attacker authentication of their own is required beyond knowledge of the sessionId, and no user interaction by the victim is needed. Limiting factors: obtaining the victim's sessionId is non-trivial (reflected in CVSS AC:H), sessions must still be valid (not expired or logged out), and deployments without authenticated users or sensitive tools have minimal impact. |
| Impact | The CVSS 4.0 base score of 8.8 reflects network reach with high confidentiality and integrity impact on both the vulnerable and a subsequent system (the connected backend tools and data), but AC:H and PR:L indicate exploitation is non-trivial and requires the attacker to first obtain a valid victim sessionId - for example via log leakage, referrer exposure, XSS, or network interception. This is consistent with the SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: total) and the low EPSS of 0.30% (21st percentile), suggesting targeted rather than opportunistic abuse. The vulnerability is real and high-impact for any internet-exposed Chainlit deployment handling sensitive data or privileged tools, but it is not a drive-by mass-exploitation candidate; prioritize patching where Chainlit fronts production LLM agents with role-based access, and treat it as medium-urgency elsewhere. |
| Exploit ScenarioDerived | An attacker who obtains a valid Chainlit sessionId for an authenticated user - for example from a leaked browser log, a shared screenshot, an HTTP referrer, or a network capture - opens a WebSocket connection and invokes the restore_existing_session path with that sessionId. Chainlit rebinds the existing authenticated identity to the attacker's socket, allowing them to invoke tools and read data as the victim. No public POC is identified at time of analysis, but the upstream patch diff makes the vulnerable code path straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 23, 2026
Session hijacking in Chainlit before 2.10.1 allows remote attackers with a valid victim sessionId to inherit an authenticated user's session via the WebSocket restore_existing_session path, which fails to verify session ownership. Successful exploitation grants the attacker the victim's roles and permissions, enabling unauthorized tool invocation and access to restricted data. No public exploit identified at time of analysis; EPSS is low (0.30%) and the issue is not listed in CISA KEV.
Earlier versions of this analysis (2)
Session hijacking in Chainlit before 2.10.1 allows remote attackers with a valid sessionId to restore another user's authenticated WebSocket session and inherit their permissions, enabling unauthorized tool invocation and data access. The flaw stems from missing ownership verification in the restore_existing_session path. No public exploit identified at time of analysis; EPSS is low (0.30%) and CISA SSVC reports no observed exploitation, but technical impact is rated total.
Session hijacking in Chainlit before 2.10.1 lets unauthenticated remote attackers take over authenticated user sessions by submitting a known sessionId during the WebSocket session restoration handshake, bypassing ownership verification. Successful exploitation grants the attacker the victim's permissions and roles, enabling unauthorized tool invocation and access to data restricted to that user. No public exploit identified at time of analysis, but a vendor patch and upstream commit are available.
RemediationAI
Vendor-released patch: upgrade Chainlit to 2.10.1 or later (https://github.com/Chainlit/chainlit/releases/tag/2.10.1), which adds session-ownership validation on WebSocket restore via PR #2857 (commit 5effb664f1e0af4a4f0a42fe63ea979676039a7f). If immediate upgrade is not possible, restrict the Chainlit WebSocket endpoint to trusted networks or place it behind an authenticating reverse proxy that binds sessions to source identity (e.g., mTLS or signed cookies), rotate any potentially exposed sessionIds, and audit logs/referrer headers/error reports that may have leaked sessionId values - be aware that network restrictions will block legitimate remote users and forced rotation will disconnect active sessions. Disabling session restoration entirely is another option but will degrade UX by forcing re-authentication on every reconnect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chainlit is an open-source Python framework for building conversational AI and LLM-powered chat applications, exposing a WebSocket interface for real-time interaction. The flaw is a CWE-862 Missing Authorization issue in the WebSocket session restoration handler (restore_existing_session), which accepts any caller presenting a known sessionId and rebinds that session's authenticated identity to the new connection without checking that the requester owns the session. As confirmed by the upstream fix in PR #2857 (commit 5effb66), the patched code adds ownership validation before restoring session state, closing the trust gap between sessionId knowledge and session ownership.
Know when Chainlit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Network-reachable WebSocket, no attacker auth (PR:N) but requires obtaining a valid sessionId (AC:H); scope changes as attacker gains victim's identity/permissions; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.
Executive ViewAI
Chainlit before version 2.10.1 contains a session hijacking vulnerability that allows attackers to impersonate authenticated users by exploiting the WebSocket restore_existing_session function, potentially granting them access to restricted tools and confidential data. Organizations using Chainlit should immediately identify affected deployments and upgrade to version 2.10.1 to prevent unauthorized access to user accounts and data. The low EPSS score (0.3%) indicates limited current exploitation risk, but successful attacks would fully compromise affected user accounts.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to t
Server-side request forgery in Chainlit before 2.9.4 lets an authenticated user coerce the server into fetching an attac
Arbitrary file read in Chainlit versions prior to 2.9.4 lets an authenticated user disclose any file readable by the Cha
Unauthenticated remote directory deletion in Chainlit through 2.12.0 allows any network-accessible attacker to recursive
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other u
Exploit-DB