Authenticated Cross-Client Result Replay in Microsoft UFO Framework

CVE-2026-46544

What is CVE-2026-46544?

The Microsoft UFO framework contains a vulnerability where the framework accepts client-supplied session_id values in WebSocket task messages. When an existing in-memory session object matches the session_id of a previously completed session, it can be reused without validating the origin of the request. This allows an attacker, equipped with knowledge of a valid session_id, to exploit the system by sending a TASK message and receiving stale results from prior sessions. This flaw poses significant risks as unauthorized clients could retrieve data meant for other users.

References