CVE-2026-66885: livebook from 0.15.0 (inclusive), before 0.18.7 (exclusive), from 0.19.0 (inclusive), before 0.19.9 (exclusive)…

Affected technology

livebook · from 0.15.0 (inclusive), before 0.18.7 (exclusive)
livebook

livebook · from 0.19.0 (inclusive), before 0.19.9 (exclusive)
livebook

livebook · 0.15.0 to before 0.18.7, 0.19.0 to before 0.19.9
livebook-dev

livebook · 0.15.0 to before 0.18.7, 0.19.0 to before 0.19.9, 0.15.0-cuda12 to before 0.18.7-cuda12, 0.19.0-cuda12 to before 0.19.9-cuda12
livebook-dev

livebook · 4380a411920531223088267ed1c0ad21f96ef660 to before *; status changes: 21c16168263275541a6e076d0c31852c40e09a18 — unaffected, 33a052daa386c4ce08a9c39a07fc90f353ff6a51 — unaffected, 6ed2e213e9d5a19a70d7fcad5a8d616622cd2084 — unaffected
livebook-dev

Component: Elixir.Livebook.ZTA.LivebookTeams, Elixir.Livebook.Teams.Requests
Function: 'Elixir.Livebook.ZTA.LivebookTeams':handle_request/4, 'Elixir.Livebook.Teams.Requests':create_auth_request/1
File: lib/livebook/zta/livebook_teams.ex, lib/livebook/teams/requests.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · Active user interaction

What an attacker can do

An attacker can authenticate a victim's browser session under the attacker's own Livebook Teams identity. Source advisory’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality impact as high; integrity and availability impact as none.