PatchSiren

m1k1o CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM m1k1o CVE published 2026-10-27

CVE-2026-116679

An authorization bypass issue exists in the legacy WebRTC input handling of Neko, allowing an authenticated room member to send unauthorized mouse and keyboard input. This issue is fixed in version 3.1.5. The vulnerability arises from a logic error in LegacyIsHost(), enabling an attacker to bypass authorization checks. Defenders should assess exposure and prioritize upgrading to version 3.1.5 or later to [truncated]