EUVD-2026-38285
GHSA-c39v-8hrw-h448
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable WebSocket, no attacker auth (PR:N) but requires obtaining a valid sessionId (AC:H); scope changes as attacker gains victim's identity/permissions; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.
AnalysisAI
Session hijacking in Chainlit before 2.10.1 allows remote attackers with a valid victim sessionId to inherit an authenticated user's session via the WebSocket restore_existing_session path, which fails to verify session ownership. Successful exploitation grants the attacker the victim's roles and permissions, enabling unauthorized tool invocation and access to restricted data. No public exploit identified at time of analysis; EPSS is low (0.30%) and the issue is not listed in CISA KEV.
Technical ContextAI
Chainlit is an open-source Python framework for building conversational AI and LLM-powered chat applications, exposing a WebSocket interface for real-time interaction. The flaw is a CWE-862 Missing Authorization issue in the WebSocket session restoration handler (restore_existing_session), which accepts any caller presenting a known sessionId and rebinds that session's authenticated identity to the new connection without checking that the requester owns the session. As confirmed by the upstream fix in PR #2857 (commit 5effb66), the patched code adds ownership validation before restoring session state, closing the trust gap between sessionId knowledge and session ownership.
RemediationAI
Vendor-released patch: upgrade Chainlit to 2.10.1 or later (https://github.com/Chainlit/chainlit/releases/tag/2.10.1), which adds session-ownership validation on WebSocket restore via PR #2857 (commit 5effb664f1e0af4a4f0a42fe63ea979676039a7f). If immediate upgrade is not possible, restrict the Chainlit WebSocket endpoint to trusted networks or place it behind an authenticating reverse proxy that binds sessions to source identity (e.g., mTLS or signed cookies), rotate any potentially exposed sessionIds, and audit logs/referrer headers/error reports that may have leaked sessionId values - be aware that network restrictions will block legitimate remote users and forced rotation will disconnect active sessions. Disabling session restoration entirely is another option but will degrade UX by forcing re-authentication on every reconnect.
Server-side request forgery in Chainlit before 2.9.4 lets an authenticated user coerce the server into fetching an attac
Arbitrary file read in Chainlit versions prior to 2.9.4 lets an authenticated user disclose any file readable by the Cha
Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to t
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today