CVE-2026-103055

Name of the Vulnerable Software and Affected Versions AiSOC versions 7.5.0 through 11.x

Description The realtime WebSocket and SSE service uses a hard-coded constant for JSON Web Token (JWT) verification when the AISOC REALTIME JWT SECRET environment variable is not configured. This allows unauthenticated attackers to forge subscription tickets using arbitrary tenant identifiers, enabling unauthorized access to cross-tenant live alerts, cases, agent events, and graph updates via the realtime endpoints.

Recommendations Update AiSOC to version 12.0.0 or later. Set the AISOC REALTIME JWT SECRET environment variable to a secure, unique value to ensure proper JWT verification.