Coral Server failed to enforce strong authentication between agents and the server during an active session, allowing an attacker who can obtain or predict a session identifier to impersonate an agent or join an existing session. This results in the attacker gaining unauthorized access to collaboration channels, potentially compromising the integrity, confidentiality, and availability of the communication, coordination, trust, and payment functions. The weakness involves authorization bypass through user-controlled keys.

The vulnerability affects all Coral-Protocol Coral Server installations using versions earlier than 1.1.0. Current releases from version 1.1.0 onward include the fix.

The CVSS score of 7.6 indicates a high impact, while the EPSS score of less than 1% suggests a very low likelihood of exploitation as of this analysis. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to obtain a valid session identifier—potentially through network sniffing, phishing, or other means—to impersonate an agent, implying that the attack vector is remote and contingent on session ID exposure.