The vulnerability lies in Pipecat’s built‑in development runner, which exposes unauthenticated endpoints such as /start, /daily, and /daily-dialin-webhook from versions 0.0.98 through 1.6.0. An attacker who can reach these endpoints can create bot sessions and Daily rooms, consume local resources and third‑party quotas, and in some configurations receive a room URL and join token. This enables unauthorized use of the framework’s services without credentials, which could lead to resource exhaustion and potential access to sensitive communications.

The affected product is pipecat‑ai’s Pipecat framework, specifically the package versions from 0.0.98 up to and including 1.6.0. Users running the development runner with the default localhost binding are safe unless they intentionally expose the service to untrusted traffic through the --host 0.0.0.0 flag, a published port, or a tunnel that lacks access controls.

The CVSS base score of 5.6 indicates a moderate impact, and the absence of an EPSS score and KEV listing suggests lower current exploitation likelihood. Nevertheless, the attack requires that the development runner be publicly accessible, which is usually a configuration or deployment error. If exposed, an unauthenticated caller can create bot sessions and consume resources, producing a tangible risk for organizations relying on Pipecat for real‑time conversational agents.