Executive brief
Microsoft UFO is an open-source framework used for automating tasks across different devices and platforms. A security flaw allows an authenticated user to access the results of another user's previous automation tasks by predicting or knowing their session ID. This could lead to the unauthorized exposure of sensitive data or task results processed by the framework.
Technical details
Microsoft UFO (specifically version 3.0.1-4-ge2626659) is vulnerable to an authenticated cross-client stale result replay. The vulnerability exists because the `SessionManager` reuses existing in-memory session objects if a client-supplied `session_id` matches an existing one, without verifying ownership or device binding. If a session has completed but remains in memory, a different authenticated client can send a WebSocket `TASK` message with that `session_id` to trigger the `send_task_end()` callback, which returns the previous session's results to the new requester. The risk is elevated because some session IDs are derived from predictable application identifiers rather than random server-generated secrets. No patch was available at the time of the advisory.
Affected products
- Microsoft UFO 3.0.1-4-ge2626659
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD