CVE-2026-116679: Incorrect Authorization in m1k1o/neko Legacy WebRTC Input Handler

m1k1o/neko is a self-hosted virtual browser and desktop environment that runs inside a Docker container and streams video, audio, and user interaction via WebRTC. In a typical deployment, multiple users connect to a shared room to view a remote X11/Xorg display. Access to interactive desktop controls—specifically the transmission of keyboard keystrokes and mouse movements via XTest and XInput—is governed by a host privilege model.

Neko supports two primary mechanisms for processing client input events: a modern WebSocket and HTTP control API, and a legacy WebRTC data channel maintained for backward compatibility with older client implementations. While the modern control API enforces strict checks against user profile capabilities and room lock states, the legacy WebRTC data channel relies on a dedicated helper function named LegacyIsHost() located in server/internal/session/session.go.

In Neko versions v3.0.0 through v3.1.4, LegacyIsHost() contains an incorrect authorization flaw classified under CWE-863 (Incorrect Authorization). When a server deployment operates with legacy mode active and the configuration option session.implicit_hosting enabled, the authorization check fails to verify whether the requesting session belongs to a permitted host or whether room controls have been locked by an administrator.

As a result of this flaw, any authenticated room member with a valid WebRTC peer connection can transmit input commands directly over the legacy data channel. The server accepts and executes these unauthorized mouse and keyboard events inside the shared virtual desktop environment, bypassing administrative restrictions (LockedControls), profile-level hosting prohibitions (CanHost == false), and private mode constraints.

The root cause of CVE-2026-116679 is a boolean logic inversion and missing guard clauses within the LegacyIsHost() method on the SessionCtx struct in server/internal/session/session.go. This method was introduced around commit fe94c999c6aff927e0c28c31b4edacf503d18871 to determine whether an active session is authorized to dispatch desktop input over the legacy WebRTC data channel.

In the vulnerable implementation, the developer attempted to combine the evaluation of the global ImplicitHosting setting, the active host check session.manager.isHost(session), and the user profile property session.profile.CanHost into a single compound boolean return statement:

return !(!implicitHosting && !session.manager.isHost(session)) || (implicitHosting && !session.profile.CanHost)

We can evaluate this expression using formal boolean algebra by defining three variables: let $I$ represent implicitHosting, $H$ represent session.manager.isHost(session), and $C$ represent session.profile.CanHost. The vulnerable expression is represented as:

$$\neg (\neg I \land \neg H) \lor (I \land \neg C)$$

Applying De Morgan's Law to the left-hand sub-expression $\neg (\neg I \land \neg H)$ yields $(I \lor H)$. Substituting this back into the full expression produces $(I \lor H) \lor (I \land \neg C)$. By the boolean absorption law, $(I \lor (I \land \neg C))$ simplifies directly to $I$, reducing the entire method's logic to:

$$I \lor H$$

Notice that in addition to the absorption error, the right-hand clause $(I \land \neg C)$ inverted the intended check on CanHost by negating it (!session.profile.CanHost). Whenever ImplicitHosting is enabled ($I = \text{true}$), the expression $(I \lor H)$ short-circuits and unconditionally evaluates to true for every connected session. Furthermore, the function completely omitted checks for session.PrivateModeEnabled() and settings.LockedControls, allowing non-admin and restricted users to bypass all room control barriers.

The vulnerability was remediated in commit 395ca1a6f62b7b0e270e654d366a2d57b8042efd (Pull Request #675). The patch replaces the flawed single-line boolean expression in server/internal/session/session.go with explicit, sequential guard clauses that mirror the authorization logic enforced by the modern control API.

File: server/internal/session/session.go
@@ -75,8 +75,14 @@ func (session *SessionCtx) IsHost() bool {
 
 // only needed for legacy webrtc handler
 func (session *SessionCtx) LegacyIsHost() bool {
-	implicitHosting := session.manager.Settings().ImplicitHosting
-	return !(!implicitHosting && !session.manager.isHost(session)) || (implicitHosting && !session.profile.CanHost)
+	settings := session.manager.Settings()
+	if !session.profile.CanHost || session.PrivateModeEnabled() {
+		return false
+	}
+	if settings.LockedControls && !session.profile.IsAdmin {
+		return false
+	}
+	return settings.ImplicitHosting || session.manager.isHost(session)
 }
 
 func (session *SessionCtx) SetAsHost() {

In the patched version of LegacyIsHost(), the server retrieves the room settings object and performs three distinct evaluations in order:

func (session *SessionCtx) LegacyIsHost() bool {
	settings := session.manager.Settings()
	// 1. Verify profile permissions and private mode state
	if !session.profile.CanHost || session.PrivateModeEnabled() {
		return false
	}
	// 2. Enforce administrative control locks against non-admin users
	if settings.LockedControls && !session.profile.IsAdmin {
		return false
	}
	// 3. Grant host status if implicit hosting is active or user is explicitly assigned host
	return settings.ImplicitHosting || session.manager.isHost(session)
}

This restructuring ensures that settings.ImplicitHosting is only evaluated after confirming that the user's profile permits hosting (CanHost == true), the session does not have private mode enabled, and room controls are either unlocked or the user holds administrator privileges (IsAdmin == true). The fix is complete for this code path and eliminates the discrepancy between legacy WebRTC data channel authorization and standard session control checks.

Exploiting CVE-2026-116679 requires network access to a vulnerable Neko instance (>= 3.0.0, < 3.1.5) configured with legacy mode enabled and NEKO_SESSION_IMPLICIT_HOSTING set to true. The attacker must also possess valid credentials for any room account, including low-privilege guest or viewer-only profiles where CanHost is explicitly disabled.

To execute the attack, the adversary authenticates to the Neko room and completes the standard WebRTC signaling handshake to establish a peer connection. Rather than requesting host control through the modern WebSocket signaling protocol—which would be rejected by the server if LockedControls is enabled or CanHost is false—the client opens the legacy WebRTC data channel dedicated to input handling.

Once the data channel is open, the attacker serializes and transmits binary or formatted mouse movement, button click, and keyboard keycode packets directly over the peer connection. When the Neko backend receives each packet on the legacy handler, it invokes session.LegacyIsHost(). Because ImplicitHosting is active, the function returns true, and the server forwards the attacker's keystrokes and pointer actions directly to the underlying Xorg display server.

No public proof-of-concept (PoC) scripts or weaponized exploit modules currently exist in ExploitDB, PacketStorm, or public GitHub repositories. However, constructing a client capable of sending input frames over the legacy WebRTC data channel is straightforward using standard WebRTC client APIs in a web browser or custom Go/Python WebRTC scripts.

CVE-2026-116679 is assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. Exploitation requires low privileges (PR:L, representing a basic room login) and no user interaction (UI:N). The vulnerability does not grant direct access to the underlying container host filesystem or server configuration secrets (C:N), keeping the CVSS scope unchanged (S:U).

Despite the medium severity rating, the practical impact within the context of a shared virtual browser session is substantial. By injecting arbitrary mouse and keyboard events, an unprivileged participant can hijack active browsing sessions being operated by an administrator or legitimate host. The attacker can navigate to arbitrary URLs, interact with web applications authenticated within the shared browser, or manipulate browser developer tools.

If the virtual browser session contains active authenticated sessions to third-party services, internal corporate dashboards, or password managers, unauthorized input injection enables the attacker to perform state-changing actions under the context of the shared browser user (I:L). Additionally, if the container desktop environment allows access to a terminal emulator or file manager via keyboard shortcuts, keyboard injection can be leveraged to execute arbitrary commands as the container's desktop user.

From an availability perspective (A:L), an attacker can continuously disrupt legitimate participants by moving the mouse cursor, closing active browser tabs or windows, or locking up the user interface. As of the latest threat intelligence evaluations, CVE-2026-116679 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and has no recorded active exploitation in the wild.

The primary remediation is to upgrade all m1k1o/neko deployments to version v3.1.5 or later, which includes commit 395ca1a6f62b7b0e270e654d366a2d57b8042efd. Containerized deployments using Docker Compose should update their image tags accordingly and recreate the running containers:

services:
  neko:
    image: ghcr.io/m1k1o/neko/firefox:v3.1.5
    restart: unless-stopped

> [!NOTE] > Ensure that any custom container images built on top of m1k1o/neko base images are rebuilt against the v3.1.5 release tag to incorporate the compiled Go binary fix.

For environments where an immediate version upgrade is not feasible, administrators can neutralize the vulnerability by applying configuration workarounds. Setting session.implicit_hosting to false prevents the boolean short-circuit in LegacyIsHost(). When ImplicitHosting ($I$) is false, the vulnerable expression $\neg(\neg I \land \neg H) \lor (I \land \neg C)$ simplifies to $H$ (session.manager.isHost(session)), restoring standard host verification:

services:
  neko:
    environment:
      NEKO_SESSION_IMPLICIT_HOSTING: "false"

Additionally, administrators should disable legacy mode and legacy WebRTC data channel handlers if support for older Neko client versions is not required. Organizations should also audit room access controls to ensure that untrusted users are not granted guest credentials to rooms running sensitive browser sessions.