Chainlit versions prior to 2.10.1 have a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without verifying session ownership. This enables attackers to assume the victim's permissions and roles, potentially invoking tools and accessing data restricted to the authenticated user.