Req Llm
Monthly
ReqLLM 1.9.0 through 1.28.0 accepts untrusted TLS certificates on its OpenAI WebSocket paths, allowing an unauthenticated on-path attacker to read or modify sessions and capture bearer tokens. Exposure is limited to applications that opt into OpenAI Responses WebSocket mode, Realtime sessions, or the Codex WebSocket path; default HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are unaffected. The vendor has released 1.29.0, the decision signal is act_now, and no public exploit identified at time of analysis.
ReqLLM 1.9.0 through 1.28.0 accepts untrusted TLS certificates on its OpenAI WebSocket paths, allowing an unauthenticated on-path attacker to read or modify sessions and capture bearer tokens. Exposure is limited to applications that opt into OpenAI Responses WebSocket mode, Realtime sessions, or the Codex WebSocket path; default HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are unaffected. The vendor has released 1.29.0, the decision signal is act_now, and no public exploit identified at time of analysis.