agentjido req_llm: Improper certificate validation in WebSocket client
Summary
The WebSocket streaming client of the Elixir library req_llm does not verify TLS certificates for OpenAI Responses, Realtime and Codex WebSocket sessions. An on-path attacker can present an untrusted certificate, read the authorization bearer token and session content, and modify frames in both directions. Applications cannot enable verification themselves because the option allowlist drops caller-supplied CA and SSL options. HTTP streaming through Finch and Mint verifies certificates and is not affected.
Affected
- req_llm from 1.9.0 before 1.29.0
- Source commits a389d718640ceb2d541a8f540ab954cbf5ef8313 to c7264fc0217fbacfb5562234ff790b8e4462de76
- Note: third-party sources give differing upper bounds (up to 1.28.9 or 1.28.0); the vendor range 'before 1.29.0' is treated as authoritative.
Fixed in
- Upgrade to req_llm 1.29.0 or later
Workaround
- Keep the openai_stream_transport option at its default :sse for the OpenAI and OpenAI Codex providers, so Responses streaming runs over HTTP through Finch
- Do not call ReqLLM.Providers.OpenAI.WebSocket.start_responses_session/2 directly
- ReqLLM.OpenAI.Realtime.connect/2 has no HTTP alternative; do not use it on an affected version
Exploitation
- No evidence of exploitation in the wild found in the reviewed sources.
- No public proof of concept repository found.
- EPSS of 0.00338 reported by Positive Technologies, suggesting low predicted exploitation probability.
- CISA KEV status: unknown.
- NVD status at time of research: Deferred.
Our recommendation
- Identify Elixir applications that use req_llm with OpenAI WebSocket features, including transitive dependencies in lockfiles (mix hex.audit).
- Upgrade to req_llm 1.29.0 or later.
- If the vulnerable path was used on untrusted networks, rotate the OpenAI API keys and OAuth tokens.
- Interim: keep the default :sse transport and avoid the WebSocket path.
- Priority: medium to high where the WebSocket features are used; low where only HTTP streaming or no LLM integration is used.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Program record (EEF) cna.erlef.org
- GitHub security advisory GHSA-6vww-5m28-f26v github.com
- OSV entry EEF-CVE-2026-107685 osv.dev
- Fix commit a389d71 github.com
- Fix commit c7264fc github.com
- Hex.pm req_llm advisories hex.pm
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:26.
Original description (NVD)
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on. The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected. This issue affects req_llm: from 1.9.0 before 1.29.0.
NVD references (5)
- https://cna.erlef.org/cves/CVE-2026-107685.html
- https://github.com/agentjido/req_llm/commit/a389d718640ceb2d541a8f540ab954cbf5ef8313
- https://github.com/agentjido/req_llm/commit/c7264fc0217fbacfb5562234ff790b8e4462de76
- https://github.com/agentjido/req_llm/security/advisories/GHSA-6vww-5m28-f26v
- https://osv.dev/vulnerability/EEF-CVE-2026-107685
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.