CVE-2026-116679 m1k1o CVE debrief

Who should care

Defenders responsible for Neko deployments using the legacy WebRTC input handler should assess exposure and prioritize upgrading to version 3.1.5 or later. They should also review and verify authorization settings for legacy WebRTC input handling and monitor for unauthorized input events. Additionally, defenders should consider implementing compensating controls for exposed systems and conducting regular security audits to detect similar issues.

Why it matters

An authorization bypass issue in Neko's legacy WebRTC input handling allows authenticated room members to send unauthorized input. Defenders should prioritize upgrading to version 3.1.5 or later.

• Potential unauthorized input events in Neko deployments
• Verification of authorization settings for legacy WebRTC input handling
• Upgrade to version 3.1.5 or later to address the issue

Technical summary

The legacy WebRTC input handling of Neko incorrectly authorizes input events due to a logic error in LegacyIsHost(). An authenticated room member may send mouse and keyboard input through the legacy WebRTC control channel even when controls are locked or the member would otherwise not be authorized through the modern control API. The issue affects only the legacy WebRTC input path, while the modern HTTP/WebSocket control path correctly enforces authorization checks. This vulnerability can be addressed by upgrading to version 3.1.5 or later.

Defensive priority

Defenders should prioritize upgrading to version 3.1.5 or later to address the authorization bypass issue in Neko's legacy WebRTC input handling.

Recommended defensive actions

• Upgrade to version 3.1.5 or later
• Review and verify authorization settings for legacy WebRTC input handling
• Monitor for unauthorized input events
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems
• Review and update incident response plans
• Conduct regular security audits to detect similar issues

Evidence notes

The issue is described in the CVE record and source item from osv_dev, which details an authorization bypass in the legacy WebRTC input handling of Neko. The CVE record was published on 2026-10-27T21:04:57.000Z and has not been modified since then. The source item from osv_dev provides additional context on the vulnerability. Defenders should verify the affected scope and severity based on the official advisory and CVE record. The logic error in LegacyIsHost() allows an authenticated room member to send mouse and keyboard input even

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.