m1k1o

CVE-2026-116679: CVE-2026-116679: Incorrect Authorization in m1k1o/neko Legacy WebRTC Input Handler CVE-2026-116679: Incorrect Authorization in m1k1o/neko Legacy WebRTC Input Handler > Vulnerability ID: CVE-2026-116679 > CVSS Score: 5.4 > Published: 2026-10-27 CVE-2026-116679 (GHSA-5cp7-fp4j-wwcv) is an incorrect authorization vulnerability (CWE-863) in m1k1o/neko, a self-hosted virtual browser running inside Docker via WebRTC. In versions from 3.0.0 prior to 3.1.5, a boolean logic inversion in the LegacyIsHost() method within server/internal/session/session.go causes the server to unconditionally grant host input privileges over the legacy WebRTC data channel when implicit hosting is enabled. Authenticated non-privileged room members can exploit this flaw to bypass room control locks and profile restrictions, allowing unauthorized injection of mouse and keyboard events into the shared virtual browser session. TL;DR A boolean logic flaw in m1k1o/neko versions 3.0.0 through 3.1.4 allows any authenticated room member to bypass control locks and inject keyboard and mouse inputs via the legacy WebRTC data channel when legacy mode and session.implicit_hosting are enabled. Upgrading to v3.1.5 resolves the vulnerability. --- Technical Details - CVE ID: CVE-2026-116679 (GHSA-5cp7-fp4j-wwcv) - Weakness Class: CWE-863: Incorrect Authorization - Affected Component: LegacyIsHost() in server/internal/session/session.go - Attack Vector: Network via Legacy WebRTC Data Channel (AV:N/PR:L) - CVSS v3.1 Score: 5.4 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - Impact: Unauthorized remote mouse and keyboard input injection into shared virtual browser - Exploit Status: No public PoCs or active exploitation reported - Patched Version: m1k1o/neko v3.1.5 Affected Systems - m1k1o/neko (Self-hosted virtual browser in Docker) - m1k1o/neko: >= 3.0.0, < 3.1.5 (Fixed in: 3.1.5) Code Analysis Commit: 395ca1a fix: correct LegacyIsHost boolean logic (#675) File: server/internal/session/session.go @@ -75,8 +75,14 @@ func (session *SessionCtx) IsHost() bool { // only needed for legacy webrtc handler func (session *SessionCtx) LegacyIsHost() bool { - implicitHosting := session.manager.Settings().ImplicitHosting - return !(!implicitHosting && !session.manager.isHost(session)) || (implicitHosting && !session.profile.CanHost) + settings := session.manager.Settings() + if !session.profile.CanHost || session.PrivateModeEnabled() { + return false + } + if settings.LockedControls && !session.profile.IsAdmin { + return false + } + return settings.ImplicitHosting || session.manager.isHost(session) } func (session *SessionCtx) SetAsHost() { Mitigation Strategies - Upgrade m1k1o/neko container deployments to version v3.1.5 or later. - Disable implicit hosting (NEKO_SESSION_IMPLICIT_HOSTING=false) to prevent unconditional evaluation of LegacyIsHost() to true. - Disable legacy WebRTC data channel support if backward compatibility with legacy clients is unnecessary. - Restrict room authentication credentials to trusted users only. Remediation Steps: 1. Locate your Neko deployment configuration (e.g., docker-compose.yaml or Kubernetes deployment manifest). 2. Update the Neko container image version tag to v3.1.5 or higher (e.g., ghcr.io/m1k1o/neko/firefox:v3.1.5). 3. If unable to upgrade immediately, set the environment variable NEKO_SESSION_IMPLICIT_HOSTING to 'false' in your configuration. 4. Restart the Neko container service to apply the updated image or configuration settings. References - GitHub Security Advisory GHSA-5cp7-fp4j-wwcv - Fix Commit 395ca1a6f62b7b0e270e654d366a2d57b8042efd (m1k1o/neko) - Pull Request #675: fix: correct LegacyIsHost boolean logic - m1k1o/neko Release v3.1.5 - Official CVE Record: CVE-2026-116679 - National Vulnerability Database (NVD) - CVE-2026-116679 - CVEListV5 JSON Record for CVE-2026-116679 --- Read the full report for CVE-2026-116679 on our website for more details including interactive diagrams and full exploit analysis.