CVE-2026-56104High· 7.4▾ TwilightChainlit contains a session hijacking vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
critical → high
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.
chainlit < 2.10.1Upgrade to a patched release:
chainlit 2.10.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45018Critical· 9.8Chainlit is a Python framework for building production-ready conversational AI applications
CVE-2026-45019High· 7.2Chainlit is a Python framework for building production-ready conversational AI applications
CVE-2025-68492Medium· 4.2Chainlit contains an authorization bypass vulnerability
CVE-2026-22219High· 7.7Chainlit contain a server-side request forgery (SSRF) vulnerability
CVE-2026-86099High· 8.2Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences
CVE-2024-0829Medium· 4.3The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0