GHSA-5cp7-fp4j-wwcv: Medium severity go/github.com/m1k1o/neko/server vulnerability
Impact
When legacy mode is enabled and session.implicithosting is enabled, the legacy WebRTC data channel incorrectly authorizes input events due to a logic error in LegacyIsHost().
As a result, an authenticated room member may be able to send mouse and keyboard input through the legacy WebRTC control channel even when controls are locked or the member would otherwise not be authorized through the modern control API.
The issue affects only the legacy WebRTC input path. The modern HTTP/WebSocket control path correctly enforces authorization checks and is not affected.
To exploit this issue, an attacker must:
Be authenticated as a room member. Successfully establish a WebRTC connection. Access a deployment using the legacy WebRTC input handler.
No unauthenticated access or privilege escalation outside the application is possible.
Patches
The issue has been fixed in v3.1.5 by correcting the authorization logic in the legacy WebRTC handler.
Users should upgrade to v3.1.5 or later. Fix: 395ca1a
Workarounds
Users who cannot immediately upgrade can mitigate the issue by one of the following:
Disable legacy mode if it is not required. Disable implicit hosting (session.implicithosting=false). Restrict access to trusted authenticated users.
Credits
Thanks to @KasperBuilds for responsibly disclosing this vulnerability and reaching out directly. This contribution helped strengthen the project, and the whole community benefits from it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/m1k1o/neko/serverto a version that resolves this vulnerability.Fixed in 0.0.0-20260805142851-395ca1a6f62b - Upgrade
Upgrade
m1k1o/nekoto a version that resolves this vulnerability.Fixed in v3.1.5Patch 395ca1a - Configuration
Disable implicit hosting by setting session.implicit_hosting=false.
neko session.implicit_hosting = false - Configuration
Disable legacy mode if it is not required.
neko legacy mode = disabled - Compensating control
Restrict access to trusted authenticated users.
Event History
Frequently Asked Questions
Which deployments are exposed?
Only deployments with both legacy mode and session.implicit_hosting enabled are affected, and only through the legacy WebRTC input handler. The modern HTTP/WebSocket control path is not affected.
What does an attacker need to exploit this?
The attacker must be authenticated as a room member, establish a WebRTC connection, and reach a deployment using the legacy WebRTC input handler. The issue does not allow unauthenticated access or privilege escalation outside the application.
What is the impact of successful exploitation?
An authenticated room member may send mouse and keyboard input through the legacy WebRTC control channel despite locked controls or missing authorization through the modern control API.
What should operators do if they cannot patch immediately?
Disable legacy mode, session.implicit_hosting, or use of the legacy WebRTC input handler where possible. The modern HTTP/WebSocket control path continues to enforce authorization checks.
Which version contains the fix?
The authorization logic was corrected in v3.1.5. Upgrade to v3.1.5 or later.