Threats affecting pkg:pypi/cheshire-cat-ai

CVE-2026-90579 is a medium severity vulnerability in Cheshire Cat AI versions 1.9.0, 1.9.1, and 1.9.2. It involves missing authentication in the _authorize_http_key function within the custom_auth_handler.py file, allowing remote attackers to manipulate the user_id argument to bypass authentication. The vulnerability has been publicly disclosed, but no patch or vendor response is currently available.