CVE-2026-56104: Chainlit Session Hijacking Vulnerability
Summary
CVE-2026-56104: Chainlit contains a session hijacking vulnerability. Affects chainlit versions < 2.10.1. Fixed in 2.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Chainlit is an open-source framework designed for building and deploying interactive applications using Python. It allows developers to create chatbots and other interactive tools that can communicate with users in real-time. However, prior to version 2.10.1, Chainlit was found to be vulnerable to a session hijacking issue, which could allow unauthorized users to gain access to authenticated sessions.
Vulnerability Detail
Chainlit versions before 2.10.1 contain a session hijacking vulnerability that enables unauthenticated attackers to restore and inherit authenticated user sessions. This occurs when an attacker presents a valid sessionId during WebSocket session restoration without any ownership verification. As a result, attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, leading to unauthorized access to tools and sensitive data that should be restricted to the authenticated user.
How To Fix
Minimum fixed version
2.10.1
This is the first release that contains the fix.
pip install --upgrade "chainlit==2.10.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional session validation mechanisms on your server to verify the ownership of sessionIds before allowing session restoration. This could involve checking user credentials or implementing token-based authentication.
Conclusion
The session hijacking vulnerability in Chainlit prior to version 2.10.1 poses a significant risk to users by allowing unauthorized access to authenticated sessions. It is crucial to update to the latest version to protect against potential exploitation. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in your projects.
See every vulnerability recorded for chainlit →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive data and perform actions on behalf of authenticated users.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
If you cannot update immediately, implement additional session validation as a temporary workaround to mitigate the risk of session hijacking.
References
Related vulnerabilities
Recent vulnerabilities recorded for chainlit.
