Missing Authentication Vulnerability in HKUDS Vibe-Trading Affects FastAPI Surface

CVE-2026-114108

What is CVE-2026-114108?

The HKUDS Vibe-Trading application versions prior to 0.1.7 exhibit a severe vulnerability where the require_auth() function can bypass authentication checks. This flaw permits unauthorized users to gain access to the FastAPI surface, allowing them to exploit various endpoints. Attackers can post malicious messages to the /sessions/{id}/messages endpoint, which can trigger execution of root shell commands through BashTool. Furthermore, they can upload Python (.py) or shell (.sh) files via /upload, review session histories, and acquire partial API keys, thereby escalating the risk of data compromise and unauthorized control.

References