CVE-2026-54695

Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake in src/pipecat/runner/utils.py, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo. This issue is fixed in version 1.4.0.

Affected

pipecat-ai · pipecat

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

CVSS v3.1 GITHUB

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H

EPSS

0.56% chance of exploitation in the next 30 days, 46th percentile

Published

2026-07-09

Updated

2026-07-10

Proof-of-concept exploits (1)

• advisories/GHSA-j8cv-x86q-rj85

Security advisories

• pipecat-ai/pipecat/security/advisories/GHSA-j8cv-x86q-rj85
• pipecat-ai/pipecat/pull/4660

References

• CVE Record
• NVD entry