Executive brief
Pipecat is an open-source framework used to build voice-based AI agents that interact with telephony services like Twilio. In versions prior to 1.4.0, a development component fails to properly verify the identity of incoming connections. This allows an unauthorized person to remotely terminate active phone calls or disrupt services by sending specially crafted messages to the server.
Technical details
A missing authorization vulnerability (CWE-862) exists in the Pipecat development runner's /ws and /ws-client WebSocket endpoints. Prior to version 1.4.0, the runner accepted unauthenticated connections and processed attacker-supplied identifiers (such as Twilio's callSid) from stream-start handshakes. These identifiers were then passed to internal serializers, causing the server to issue authenticated REST API 'hang-up' requests using the server operator's stored credentials. This allows a remote, unauthenticated attacker to perform unauthorized call control actions. The fix introduces optional HMAC-SHA256 token authentication for WebSocket connections, requiring a signed session token obtained via a POST /start request.
Affected products
- pipecat-ai Pipecat < 1.4.0
Timeline
- 2026-06-08: patched: HMAC token authentication merged into main branch
- 2026-07-09: advisory: NVD and GitHub Security Advisory published
References
- https://github.com/pipecat-ai/pipecat/commit/3032da53434c5ef01d368654b3551cf21c50dec9
- https://github.com/pipecat-ai/pipecat/commit/88440676996e5e548e1aecea5d565e1c48ccf6fa
- https://github.com/pipecat-ai/pipecat/pull/4660
- https://github.com/pipecat-ai/pipecat/releases/tag/v1.4.0
- https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-j8cv-x86q-rj85