CVE-2026-103057 describes an authentication bypass vulnerability in beenuar AiSOC's realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Versions 5.1.0 through 11.x are affected. The vulnerability enables attackers to send arbitrary events with spoofed tenant IDs, which can be used to broadcast malicious content over WebSocket and Redis Server-Sent Events channels or to send unauthorized notifications to registered devices. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector with no privileges required and no user interaction needed, but limited impact on integrity.

Attackers can exploit this vulnerability to bypass authentication controls on critical internal endpoints, allowing them to inject arbitrary events and notifications. This could lead to unauthorized broadcast of malicious content to clients connected via WebSocket and Redis SSE channels, potentially disrupting service or misleading users. However, the impact is limited to integrity and does not affect confidentiality or availability according to the CVSS vector.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to internal realtime service endpoints and monitor for suspicious activity related to event posting.