Coral Server Session Authentication Bypass Vulnerability

A session authentication bypass vulnerability has been identified in Coral Server versions prior to 1.1.0. The issue arises in the '/api/v1/sessions' endpoint, which allows the creation of agent sessions without strong authentication. This endpoint is resource-intensive, performing operations such as container spawning and memory context creation. An attacker who can access this endpoint could create unauthorized sessions or consume system resources.

Impact

Exploitation of this vulnerability allows for unauthorized creation of agent sessions and consumption of system resources, potentially leading to a denial-of-service condition.

Remediation

Users can upgrade to Coral Server version 1.1.0 or later to address this vulnerability.