CVE-2026-56104: Chainlit contains a session hijacking vulnerability

When a client reconnects, Chainlit's restore_existing_session path rebinds the new socket to the existing session named by sessionId. Before 2.10.1 it did not compare the connecting user with the session's owner. Presenting a valid ID was enough to inherit the session, along with its permissions and roles.

The attacker must know a valid session ID of an authenticated user. The sources do not say how they get one. The CVSS 3.1 vector uses high attack complexity, which fits the need for a leaked or guessed ID. How an ID could leak is a separate question, for example through logs or a shared URL. Once the attacker has it, no user interaction is needed.

The result is that the attacker acts as the victim in the chat app. They can invoke tools the victim is allowed to use and see data restricted to the victim. For Chainlit apps that wrap AI agents with tools, such as database queries or file access, that is the victim's whole reach. The 4.0 score is 9.1 and the 3.1 score is 7.4. VulnCheck lists 8.8.

The pip package chainlit before 2.10.1, in apps where users authenticate and the app is reachable over WebSocket. Check the installed version:

pip show chainlit

Apps with no authentication have no per-user identity to protect, though the fix still allows only anonymous-to-anonymous restoration.

Upgrade to Chainlit 2.10.1.

pip install --upgrade chainlit==2.10.1

Pull request 2857 passes the authenticated user into restore_existing_session, which now runs _session_owner_matches_user before it rebinds the socket. A cross-user restore raises ConnectionRefusedError("authorization failed"). Same-user restore and anonymous-to-anonymous restore work as before. The sources list no workaround for older versions.

Look in server logs for a session ID that connects from two different users, IP addresses or clients in a short span. After the upgrade, authorization failed refusals on WebSocket connect can mark attempts to restore someone else's session. Review tool invocations and data access performed in sessions that show a change of client. Treat any leaked session ID as a compromised credential.

Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.