CVE-2026-93839 describes an authentication bypass vulnerability in ModelTC LightLLM through version 1.2.0. The issue exists in the /pd_register WebSocket endpoint, where attackers can bypass authentication by supplying crafted JSON data that lacks peer address validation. This enables attackers to register arbitrary nodes, potentially exposing full user prompts routed to their socket, causing denial of service by replacing legitimate nodes, and forcing the PD Master to issue requests to internal network addresses. The vulnerability is remotely exploitable without privileges or user interaction and has a high impact on confidentiality, integrity, and availability.

The vulnerability allows unauthenticated remote attackers to register arbitrary nodes, leading to disclosure of sensitive user prompts, denial of service by node replacement, and unauthorized internal network requests. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /pd_register WebSocket endpoint and monitor for suspicious registration attempts.