CVE-2026-116679
Description
A flaw was found in Neko, a virtual browser platform. When legacy mode and implicit hosting configurations are enabled, the application fails to properly verify host authorization for legacy WebRTC (Web Real-Time Communication) data channels. An authenticated room member can exploit this vulnerability to send unauthorized keyboard and mouse events, bypassing session control locks to interact with the active browser.
Statement
This vulnerability is rated as Moderate because exploitation requires established user credentials within an active room and depends on non-standard configurations being simultaneously enabled. Although an authenticated attendee can circumvent control locks across legacy communication channels to transmit keystrokes and pointer events, the flaw does not facilitate container breakout or host-level code execution. In addition, contemporary control endpoints correctly maintain authorization boundaries and are not exposed.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
