Executive brief
Cohere North AI is an enterprise AI platform that automates workflows and accelerates decision-making for business teams. A vulnerability in its WebSocket endpoint allows unauthenticated attackers to receive sensitive internal data including IP addresses, user details, HTTP headers, and privilege levels, enabling reconnaissance for follow-on attacks.
Technical details
The vulnerability is an information disclosure flaw (CWE-200) in the WebSocket endpoint at wss://example.com/admin/api/_event/?EIO=4&transport=websocket. The server responds with sensitive internal system information in WebSocket messages that should not be transmitted to clients, including internal IP addresses, user lists, HTTP headers, and privilege/role information. An attacker can connect to the endpoint and send standard WebSocket handshake and subscribe messages to trigger responses containing this sensitive data. The attack requires network access to the WebSocket endpoint but no authentication or user interaction. Successful exploitation enables reconnaissance of internal infrastructure and facilitates privilege escalation attacks. No patch information is currently available in the advisory.
Affected products
- Cohere North AI 1.1.5
Timeline
- 2025-11: disclosed: Publicly disclosed in November 2025
- 2026-08-26: advisory: Published on NVD