Zero Radar
← feed
MediumVulnerabilityCVE-2026-116679updated 28 Oct 2026, 15:25 UTC

Neko: Authorization bypass in legacy WebRTC input handling

Fix availableOfficial, 2 sources
SeverityMediumCVSS 5.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesgithub.com/m1k1o/neko/server 0.0.0-20260805142851-395ca1a6f62b · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

Are you affected?

Package / productAffected versionsFixed in
github.com/m1k1o/neko/server · go>= 0.0.0-20250401220545-fe94c999c6af, < 0.0.0-20260805142851-395ca1a6f62b0.0.0-20260805142851-395ca1a6f62b

Timeline

  1. 27 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 21:04 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 21:05 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 15:25 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116679 · GHSA-5cp7-fp4j-wwcv
CVSS
5.4 / 10
Disclosed
27 Oct 2026, 18:17 UTC
On Zero Radar
27 Oct 2026, 21:05 UTC (3 h after disclosure)
Last change
28 Oct 2026, 15:25 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Neko: Authorization bypass in legacy WebRTC input handling · Zero Radar