CVE Intelligence
Analysis AI-assisted

CVE-2026-42889: Relay Server Authentication Bypass in WebSocket Endpoints

Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints, where connections without a token parameter were treated as having full server permissions. An unauthenticated network attacker who knows or guesses a document ID could read or modify document contents. The record states the issue is fixed in 0.9.7.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Relay Server is the backend for Relay, a real-time collaboration tool for Obsidian. CVE-2026-42889 describes an authentication bypass in the multi-document WebSocket endpoints, classified as CWE-639 (authorization bypass through a user-controlled key). According to the record, the flaw affects Relay Server 0.9.0 through 0.9.6 and is fixed in 0.9.7.

Impact

  • An unauthenticated network attacker who knows or guesses a document ID could connect to the document sync WebSocket.
  • The record states that such a connection could read or modify document contents without a valid document token.
  • The CVSS 3.1 vector reported by the CNA indicates high confidentiality and integrity impact with no availability impact, and a base score of 9.1 (critical).

Affected products and versions

  • Relay Server 0.9.0 through 0.9.6, as stated in the description.
  • Relay Server 0.9.7 is identified as the fixed version in the description.
  • The structured affected and fixes fields in the record are empty, so version information here comes from the description text and the advisory reference.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS value in the record is 0.00531 (percentile 0.43367), which estimates likelihood of exploitation but is not evidence of observed attacks.

Remediation and mitigation

  • Upgrade Relay Server to version 0.9.7 or later, as indicated by the record.
  • If an immediate upgrade is not possible, restrict network access to the server to trusted users and networks, since the flaw is reachable over the network.
  • Confirm that authentication is configured on the server, and review how document IDs are generated and shared, because the attack depends on knowing or guessing them.
  • Inference: after upgrading, review whether documents were accessed or changed while the server was exposed.

Detection guidance

  • Review WebSocket connection logs for connections to multi-document endpoints that lack a token parameter.
  • Look for document sync sessions from unexpected sources or accessing document IDs that the owning users did not expect.
  • Correlate server access logs with document change history to spot unexplained modifications.

Limitations of the available information

  • The record contains only the description, CVSS data, CWE classification, EPSS data and one advisory reference; it does not include detailed affected configurations, exact endpoint paths or a structured list of fixed versions.
  • The record's source status is Deferred, and the title was missing from the record, so the title here was written from the description.
  • The EPSS date in the record is later than the publication date, so its timing should be interpreted with care.
  • No information on whether public proof-of-concept material exists was present in the record.

Frequently asked questions

Which Relay Server versions are affected by CVE-2026-42889?

According to the record, Relay Server versions 0.9.0 through 0.9.6 are affected, and version 0.9.7 contains the fix.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.