Coral Server’s SSE endpoint (/sse/v1/...) lacks sufficient validation of an agent’s identity, allowing an unauthorized party to potentially inject messages into or observe data streams that belong to legitimate sessions. This weakness is a classic case of missing access control (CWE‑862) and could compromise the confidentiality and integrity of communication between agents. The vulnerability is theoretical but could be exploited to tamper with or eavesdrop on collaboration data, payments, or trust exchanges handled by the server.

The issue exists in all Coral‑Protocol Coral Server releases before version 1.1.0. Only the SSE path is affected, and the fix is included starting with Coral Server 1.1.0. The vulnerability affects deployments of the Coral Server component of the Coral Protocol open collaboration infrastructure.

The CVSS score of 8.6 places the flaw in the high‑severity range. However, the EPSS score of less than 1% suggests the likelihood of exploitation is currently low, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to establish a session over the SSE endpoint without sufficient identity verification; the vulnerability can be triggered without any privileged knowledge beyond the endpoint’s existence and the ability to connect as an agent. Consequently, the threat is moderate to high, warranting timely remediation but not immediate emergency response.