Remote Admin Control Vulnerability in Neko Virtual Browser by m1k1o
CVE-2026-39386
8.8HIGH
What is CVE-2026-39386?
The Neko Virtual Browser versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 contain a serious vulnerability that allows any authenticated user to gain full administrative control over the Neko instance. This includes managing users, modifying room settings, controlling broadcasts, and terminating sessions. As a result, the entire instance is at risk of being compromised. To mitigate risks while not yet upgraded, it is advised to restrict user access, use strong passwords, and implement additional layers of security such as reverse proxies. However, it is strongly recommended to upgrade to patched versions 3.0.11 or 3.1.2 to fully resolve the vulnerability.
Affected Version(s)
neko >= 3.0.0, < 3.0.11 < 3.0.0, 3.0.11
neko >= 3.1.0, < 3.1.2 < 3.1.0, 3.1.2