Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. In versions prior to 1.4.0 the development runner registers a \/ws WebSocket endpoint for telephony testing that accepts connections without authentication. The endpoint reads an attacker-supplied callSid from a Twilio stream-start handshake and passes it to TwilioFrameSerializer, enabling the server to issue an authenticated Twilio REST API hang-up request using the operator’s credentials. This missing authorization allows an unauthenticated attacker to terminate or otherwise control voice calls without permission, representing a CWE-862 weakness. Equivalent unauthenticated call-control sinks exist for Telnyx and Plivo.

Any Pipecat installation running the development runner with the \/ws endpoint enabled and using a version earlier than 1.4.0 is vulnerable. The issue is confined to the \/ws endpoint used for telephony testing and does not affect other aspects of the framework. The flaw also applies to equivalent Telnyx and Plivo call-control sinks, but only when the development runner is in use.

The CVSS score of 7.5 indicates a high severity of remote attack potential. The EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV, suggesting that industry-wide exploitation is currently low, yet the barrier to attack is minimal. An attacker only needs connectivity to the open WebSocket endpoint; no credentials are required, making the vulnerability readily exploitable in unprotected environments.