# CVE-2026-56104: Chainlit session hijacking in WebSocket session restoration

Source: https://junglewise.ai/threats/cve-2026-56104-chainlit-session-hijacking-in-websocket-session-restoration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-56104 · Severity: high · CVSS 7.4 · Published 2026-06-22

Chainlit, a framework for building AI applications, contains a security flaw that allows unauthorized individuals to take over active user sessions. By providing a valid session ID, an attacker can bypass ownership checks and gain the same permissions as a legitimate user. This could lead to the unauthorized access of sensitive data or the execution of tools and actions on behalf of the victim.

Technologies: [Chainlit](https://junglewise.ai/threats/technologies/chainlit), [chainlit (PyPI)](https://junglewise.ai/threats/technologies/pypi-chainlit). Vendors: [Chainlit](https://junglewise.ai/threats/vendors/chainlit), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-56104 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56104 being exploited in the wild.

**How severe is CVE-2026-56104?** High severity, with a CVSS score of 7.4, published 22 June 2026.

**Which products and versions are affected?** Chainlit < 2.10.1; chainlit (PyPI) ECOSYSTEM:introduced=0,fixed=2.10.1.

**Is there a fix for CVE-2026-56104?** Yes. chainlit (PyPI): upgrade to 2.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56104 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56104?** Check whether you run Chainlit or chainlit (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- chainlit (PyPI): upgrade to 2.10.1 or later

  ```sh
  pip install "chainlit>=2.10.1"
  ```


## Technical details

A session hijacking vulnerability exists in Chainlit's WebSocket session restoration mechanism. The 'restore_existing_session' path failed to verify if the authenticated user requesting a session restoration actually owned the session associated with the provided 'sessionId'. An attacker who obtains a valid session ID can exploit this lack of authorization (CWE-862) to assume the victim's roles and permissions. This allows for unauthorized tool invocation and access to restricted data. The issue is mitigated in version 2.10.1 by implementing the '_session_owner_matches_user' check during the WebSocket rebind process.

## Affected products

- Chainlit Chainlit < 2.10.1

## Identifiers

- CVE-2026-56104
- GHSA-c39v-8hrw-h448
- PYSEC-2026-4028

## Timeline

- 2026-03-24: patched: Fix merged via Pull Request #2857
- 2026-03-27: advisory: Release 2.10.1 published
- 2026-06-22: disclosed: CVE-2026-56104 published to NVD

## References

- [https://github.com/Chainlit/chainlit/commit/5effb664f1e0af4a4f0a42fe63ea979676039a7f](https://github.com/Chainlit/chainlit/commit/5effb664f1e0af4a4f0a42fe63ea979676039a7f)
- [https://github.com/Chainlit/chainlit/pull/2857](https://github.com/Chainlit/chainlit/pull/2857)
- [https://github.com/Chainlit/chainlit/releases/tag/2.10.1](https://github.com/Chainlit/chainlit/releases/tag/2.10.1)
- [https://www.vulncheck.com/advisories/chainlit-session-hijacking-via-websocket-session-restoration](https://www.vulncheck.com/advisories/chainlit-session-hijacking-via-websocket-session-restoration)

## Related threats

- [Chainlit MCP path validation bypass via semicolon](https://junglewise.ai/threats/cve-2026-120492-chainlit-2-12-0-contains-a-server-side-request-forgery)
- [Chainlit path traversal and directory deletion via sessionId](https://junglewise.ai/threats/cve-2026-86099-chainlit-path-traversal-and-directory-deletion-via-sessionid)
- [Chainlit authorization bypass in feedback endpoints](https://junglewise.ai/threats/cve-2026-82290-chainlit-authorization-bypass-in-feedback-endpoints)
- [Chainlit server-side request forgery via MCP transports](https://junglewise.ai/threats/cve-2026-45019-chainlit-server-side-request-forgery-via-mcp-transports)
- [Chainlit command injection in MCP stdio transport](https://junglewise.ai/threats/cve-2026-45018-chainlit-command-injection-in-mcp-stdio-transport)