Vulnerability · Published Sep 30, 2026 · Assigned by VulnCheck
CVE-2026-103057AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints
Medium 4.3
In plain English
A medium-severity missing authentication in AiSOC from beenuar. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 65.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-mqjp-pcpr-7c37) vendor-advisory
- https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43 patch
- AiSOC v12.0.0 Release Notes release-notes
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/index.ts#L681-L691 technical-description
- VulnCheck Advisory: AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints third-party-advisory