Microsoft UFO version 3.0.1-4-ge2626659 accepts client-supplied session identifiers in WebSocket task messages and reuses an existing in-memory session if that session_id already exists. When a previously completed session remains in memory, a different authenticated user can send a new TASK message using the same session_id. The server then re-enters the session and sends the stored, stale result to the new requester through the normal send_task_end() callback. This produces an authenticated cross-client replay of stale task results, potentially revealing confidential information that the attacker did not originally authorise.

Microsoft UFO – version 3.0.1-4-ge2626659 is affected. The issue is triggered when client-supplied session_id values are accepted on the WebSocket endpoint. No other Microsoft products are listed as impacted in the current advisory.

The CVSS score of 5.3 classifies the vulnerability as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires authenticated access and knowledge or prediction of a live or recently completed session_id, meaning that an attacker must first obtain legitimate authentication before the replay can occur. If the attacker obtains these credentials, they can potentially read stale results intended for previous users, leading to information disclosure. The vulnerability can be mitigated by upgrading to a patched version, if available, or applying workarounds until an official fix is released.