Unauthenticated Remote Access Vulnerability in Anagnorisis Socket.IO Interface

CVE-2026-97231 describes a critical security flaw in the volotat Anagnorisis application, specifically affecting versions up to 0.3.1 and 0.4.0. The vulnerability resides within the Socket.IO Connect Interface defined in the app.py file. Analysis indicates that the component fails to properly implement authentication for Socket.IO connections, which allows remote, unauthenticated actors to interact with the interface. Since the application is designed to handle potentially sensitive data or control logic via Socket.IO, this flaw provides a vector for unauthorized access or execution of administrative commands without requiring valid credentials. Public exploits for this vulnerability are currently available, increasing the risk of exploitation. The vendor has not provided a patch or response to reports regarding this issue, leaving current deployments in a vulnerable state.

Impact

Successful exploitation allows remote attackers to bypass authentication entirely, gaining unauthorized access to the application's interface. Depending on the specific functionality exposed via the Socket.IO component, this could lead to information disclosure, unauthorized data modification, or service disruption for organizations relying on Anagnorisis.

Recommendation

Prioritize the identification of all internet-facing instances of Anagnorisis within the environment. Since no vendor patch is currently available, network-level access controls should be implemented to restrict access to the Socket.IO endpoint to trusted IP addresses. Monitor web and application server logs for abnormal or unauthorized WebSocket handshake requests targeting the affected interface.