Skip to content
fr Sign in
5.3 Medium

CVE-2026-46544 Microsoft UFO open-source framework for intelligent automation across devices and platforms

Description

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO accepts client-supplied session_id values in WebSocket task messages and reuses an existing in-memory session object if that session_id already exists. If a prior session has completed and remains in memory with populated results, a different authenticated client can send a new TASK message using the same session_id. The server re-enters the existing session object and sends the stale stored result to the new requester through the normal send_task_end() callback path. This is an authenticated cross-client stale result replay issue. The issue requires that the attacker knows or can predict a live or recently completed session_id.

Affected products and versions

Product Affected versions Fixed in
UFO 3.0.1-4-ge2626659 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of UFO

The 17 CVEs of UFO →
CVE-2026-105793 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms 9.1 Critical CVE-2026-105792 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms 6.5 Medium CVE-2026-105791 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms 7.5 High CVE-2026-105790 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms 6.4 Medium
Track this CVE