PT-2026-40422 · Unknown · Relay-Server

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-42889

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Relay Server versions 0.9.0 through 0.9.6

Description An authentication bypass exists in the multi-document WebSocket endpoints. When authentication is enabled, WebSocket connections lacking a token query parameter are incorrectly granted full server permissions. This allows an unauthenticated network attacker who possesses or guesses a document ID to connect to the document sync WebSocket and read or modify document contents without a valid document token.

Recommendations Update Relay Server to version 0.9.7.

Exploit

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2026-42889

Affected Products

Relay-Server

References · 3

• 🔥 https://github.com/No-Instructions/relay-server/security/advisories/GHSA-9vp9-8q9j-8mqm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42889 · Security Note
• https://twitter.com/CVEnew/status/2054324080153923874 · Twitter Post