PT-2026-104036 · Undefined · Undefined
CVE-2026-51878
·
Published
2026-10-01
·
Updated
2026-10-01
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate last turn. A remote caller can enumerate or obtain a session id and trigger regenerate on another user's session.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined