Coral Server Session Authentication Vulnerability Allowing Agent Impersonation

A vulnerability in Coral Server prior to version 1.1.0 allowed for weak authentication between agents and the server during active sessions. This flaw could be exploited by an attacker who obtained or predicted a session identifier, enabling them to impersonate an agent or join an existing session.

Impact

Exploitation of this vulnerability could lead to unauthorized impersonation of agents or interference with active sessions.

Remediation

Users can upgrade to Coral Server version 1.1.0 or later to address this vulnerability. The update introduces per-agent session secrets that are required for communication between agents and the server, enhancing authentication security.