Improper Certificate Validation in WebSocket Client of Agentjido's ReqLLM Product

CVE-2026-107685

What is CVE-2026-107685?

An improper certificate validation vulnerability exists in the WebSocket streaming client of agentjido's ReqLLM. This flaw permits an on-path attacker to intercept and manipulate WebSocket sessions involving OpenAI's services, thereby risking the exposure of sensitive authorization tokens. The underlying issue arises because the WebSocket client, when initiating connections, does not enforce secure TLS options, leading it to default to insecure settings that skip necessary certificate verification. This situation enables attackers to exploit the trust relationship and potentially access delicate data, including API keys and OAuth tokens embedded in the authorization headers.

References