CVE-2026-56104: Chainlit Session Hijacking Vulnerability
Summary
CVE-2026-56104: Chainlit contains a session hijacking vulnerability. Affects chainlit versions < 2.10.1. Fixed in 2.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Chainlit is an open-source framework designed for building interactive applications using Python. It allows developers to create user-friendly interfaces for their applications, enabling real-time communication and data processing. However, prior to version 2.10.1, Chainlit was susceptible to a session hijacking vulnerability that could compromise user sessions.
Vulnerability Detail
Chainlit before version 2.10.1 contains a critical session hijacking vulnerability. This flaw allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without proper ownership verification. As a result, attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, leading to unauthorized access to sensitive data and tools that are restricted to the authenticated user.
How To Fix
Latest published version: 2.12.0 as of 23 Oct 2026
pip install --upgrade "chainlit==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.10.1
This is the first release that contains the fix.
pip install --upgrade "chainlit==2.10.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional session validation checks on the server-side to ensure that sessionIds are only accepted from authenticated users. This may involve modifying the WebSocket session restoration logic to include ownership verification.
Conclusion
The session hijacking vulnerability in Chainlit poses a significant risk to user data and application integrity. It is crucial for users to update to version 2.10.1 or later to mitigate this risk. Additionally, implementing temporary workarounds can help protect against potential exploits until the update is applied.
See every vulnerability recorded for chainlit →
FAQ
The vulnerability allows attackers to impersonate authenticated users, potentially leading to unauthorized access to sensitive data and functionalities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement server-side session validation as a temporary measure to mitigate the risk.
The CVSS score for this vulnerability is 7.4, indicating a critical level of severity.
Detailed information can be found in the advisory on GitHub or through the CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for chainlit.
