CVE-2026-54695

Name of the Vulnerable Software and Affected Versions Pipecat versions prior to 1.4.0

Description The pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication. An unauthenticated remote attacker can connect to this endpoint and send a crafted handshake message containing an attacker-supplied callSid variable. The server reads this value in src/pipecat/runner/utils.py and passes it to the TwilioFrameSerializer (or equivalent sinks for Telnyx and Plivo). When the pipeline terminates, the server uses its own operator credentials to issue an authenticated REST API hang-up request to the telephony provider using the injected callSid. This allows an attacker to forcibly terminate active calls or cause a denial of service on the victim's account if a valid call identifier is known.

Recommendations Update to version 1.4.0 or later and enable WebSocket token authentication by setting PIPECAT WEBSOCKET AUTH=token or using the --ws-auth token flag when starting the bot. As a temporary mitigation, restrict access to the /ws WebSocket endpoint to localhost or trusted networks to prevent unauthenticated remote access.