CVE-2026-116679

Name of the Vulnerable Software and Affected Versions Neko versions 3.0.0 through 3.1.4

Description Neko deployments using legacy mode with session.implicit hosting enabled contain a logic error in the LegacyIsHost() function. This causes the legacy WebRTC data-channel to incorrectly authorize input events. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel, bypassing authorization checks even when controls are locked or the member is unauthorized by the modern control API.

Recommendations Update to version 3.1.5. Disable legacy mode if it is not required. Set session.implicit hosting to false. Restrict access to trusted authenticated users.