Submit #984380: HBAI-Ltd Toonflow-app 1.1.8 Sensitive information exposure

## 1. Vulnerability Description

When the Toonflow desktop application is running, it starts an HTTP service on the local machine. A combination of three issues—a default administrator account, unrestricted cross-origin access, and a full database export endpoint—allows a malicious web page visited by the user to automatically discover the local Toonflow service, authenticate with default credentials, call the database export endpoint, and read the exported database directly in browser JavaScript.

The export contains every non-SQLite-internal business table, including at least:

- `o_user.password`: the user's login password. In the current implementation it is stored in plaintext, with the default value `admin123`.
- `o_setting.tokenKey`: the JWT signing key. Once disclosed, an attacker can forge valid JWTs.
- `o_vendorConfig.inputValues`: vendor model configuration, which typically contains third-party model service API keys.

The attack does not require the user to enter anything into the malicious web page or to click any feature in the application. While Toonflow is running, simply visiting the malicious page is enough for the page to discover the service, log in, export the database, and extract the sensitive fields.

The impact includes:

1. Theft of configured third-party model API keys, creating direct financial and account-security risk.
2. Theft of the application JWT signing key, allowing forged long-lived authentication tokens.
3. Theft of the plaintext user password. If the password is reused elsewhere, this can enable further compromise.
4. Export of all business tables, potentially including projects, scripts, asset URLs, model configuration, and agent configuration.

## 2. Affected Version and Attack Conditions

Affected component: the HTTP service embedded in the Toonflow desktop application.

Tested version: `1.1.8`.

Risk rating: High. A malicious web page can read third-party API keys, the JWT signing key, and the plaintext user password, and can export all business data.

Attack conditions:

- Toonflow is running on the target user's machine.
- The default administrator account `admin/admin123` remains unchanged, or the attacker knows another valid credential.
- The user opens an attacker-controlled web page in a modern browser.
- The local firewall does not block browser access to the loopback address and Toonflow's random port.

Electron production mode uses a random port, but this does not eliminate the risk. A malicious page can probe common ports `10588` and `50188`, followed by the local dynamic port range `32768-65535`. The service can be identified by its response structure and error message. Randomization only modestly increases discovery cost and does not prevent the attack.

• Benutzer: notwolf (UID 101189)
• Einreichung: 16.09.2026 16:05 (vor 27 Tagen)
• Moderieren: 12.10.2026 21:08 (26 days later)
• Status: Akzeptiert
• VulDB Eintrag: 417195 [HBAI-Ltd Toonflow-app bis 1.1.8 exportData Endpoint Information Disclosure]
• Punkte: 20