CVE-2026-107685 PUBLISHED

WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers

Assigner: EEF
Reserved: 10.10.2026 Published: 23.10.2026 Updated: 23.10.2026

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.

The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.

This issue affects req_llm: from 1.9.0 before 1.29.0.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 9.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	agentjido
Product	req_llm
Versions	Default: unaffected affected from 1.9.0 to 1.29.0 (excl.)

Vendor	agentjido
Product	req_llm
Versions	Default: unaffected affected from a389d718640ceb2d541a8f540ab954cbf5ef8313 to c7264fc0217fbacfb5562234ff790b8e4462de76 (excl.)

Workarounds

Leave the openai_stream_transport provider option at its default :sse for the OpenAI and OpenAI Codex providers, and do not call ReqLLM.Providers.OpenAI.WebSocket.start_responses_session/2 directly. Responses streaming then runs over HTTP through Finch, which verifies certificates. ReqLLM.OpenAI.Realtime.connect/2 has no HTTP alternative, so do not use it on an affected version.

Credits

Neil Berkman reporter
Neil Berkman finder
Mike Hostetler remediation developer
Jonatan Männchen / EEF coordinator

References

Problem Types

CWE-295 Improper Certificate Validation CWE

Impacts

An attacker on the network path between an application and the OpenAI endpoint presents their own certificate, obtains the OpenAI API key or OAuth access token and the full session content, and can alter model output and tool calls before the application acts on them. Every application that uses the OpenAI Responses, Realtime, or Codex WebSocket paths is affected.