| タイトル | https://github.com/Zackriya-Solutions/ meetily 0.4.1 Missing Authentication |
|---|
| 説明 | Self-Hosted Backend Has No Authentication on Any Endpoint, Exposing Stored LLM Provider API Keys and All Meeting Transcripts
I am writing to report that the self-hosted backend has no authentication at all, and is published to all network interfaces by default in the documented Docker deployment.
Affected component: `backend/app/main.py` (all routes), `backend/docker-compose.yml` (`meetily-backend` service port publishing)
Affected versions: confirmed against the current default branch as of 2026-10-13
CVSS 3.1 score: 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
## Root cause
No route in `main.py` has an authentication dependency or checks any credential. The application itself binds `uvicorn` to `x.x.x.x`, and the documented Docker Compose deployment publishes the backend's port to the host's `x.x.x.x` by default. Any network client that can reach that port has full, unauthenticated access to every endpoint, including reading and overwriting the stored LLM provider API key.
## Steps to reproduce
(available upon request)
## Impact
Any network client reaching a self-hosted instance can steal or replace the owner's LLM provider API key and read, modify, or delete all stored meeting transcripts and summaries, with no credentials of any kind.
## Suggested fix
Require an authentication mechanism (at minimum, a locally-generated shared secret set at first run, with every route requiring it) before the backend serves any business endpoint. Bind the backend to `127.0.0.1` by default rather than `x.x.x.x`, requiring an explicit opt-in (with a clear warning) to expose it beyond localhost, and never store provider API keys in a form retrievable without authentication. |
|---|
| ソース | ⚠️ https://github.com/Zackriya-Solutions/meetily/issues/845 |
|---|
| ユーザー | carfeii (UID 97470) |
|---|
| 送信 | 2026年10月18日 16:08 (25 日 ago) |
|---|
| モデレーション | 2026年11月12日 18:51 (25 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 436458 [Zackriya-Solutions Meetily 迄 0.4.1 backend/app/main.py 弱い認証] |
|---|
| ポイント | 20 |
|---|