CVE-2026-51878: Deeptutor vulnerability
deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regeneratelastturn. A remote caller can enumerate or obtain a sessionid and trigger regenerate on another user's session.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a valid session_id belonging to another user. The session_id may be obtained or enumerated, after which a remote caller can invoke regenerate_last_turn for that session.
Who is exposed to unauthorized regeneration?
Users whose session_id can be obtained or enumerated by another remote caller are exposed. The issue allows the caller to trigger regeneration on another user's session rather than only their own.
How can I determine whether an instance is affected?
The reported affected version is deeptutor 1.4.0. An affected instance permits a caller to use a different user's session_id with TurnRuntimeManager.regenerate_last_turn and trigger regeneration without authorization.