Neko, a self-hosted virtual browser, has a flaw that lets any authenticated user gain full administrative control over the entire instance, including member management, room settings, broadcast control, and session termination. This gives the attacker complete compromise of the instance. The weakness is reflected in multiple CWE identifiers, such as unchecked input (CWE‑20) and missing access control (CWE‑269, CWE‑284, CWE‑639, CWE‑862).

The affected product is Neko from m1k1o. Versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 are vulnerable. The issue has been patched in releases v3.0.11 and v3.1.2.

The CVSS score of 8.8 indicates a high severity vulnerability. The exploit requires only a legitimate authenticated session; an attacker who can log in can perform privileged operations via the web interface or API. Although no EPSS score is available and it is not listed in the CISA KEV catalog, the impact of a successful exploit is total administrative takeover of the instance. Because the vulnerability is driven by the attacker’s credential, the attack vector is likely evaluated as authenticated. Typical environments that expose Neko to the public internet face a higher risk, especially if weak or shared passwords, or unrestricted reverse proxies, are present.