CVE-2026-107685 - WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
CVE ID :CVE-2026-107685 Published : Oct. 23, 2026, 11 a.m. | 1 hour, 14 minutes ago Description :Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the...