Отправить #1041189: https://github.com/Zackriya-Solutions/ meetily 0.4.1 Missing Authentication

Self-Hosted Backend Has No Authentication on Any Endpoint, Exposing Stored LLM Provider API Keys and All Meeting Transcripts

I am writing to report that the self-hosted backend has no authentication at all, and is published to all network interfaces by default in the documented Docker deployment.

Affected component: `backend/app/main.py` (all routes), `backend/docker-compose.yml` (`meetily-backend` service port publishing)
Affected versions: confirmed against the current default branch as of 2026-10-13
CVSS 3.1 score: 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

## Root cause

No route in `main.py` has an authentication dependency or checks any credential. The application itself binds `uvicorn` to `x.x.x.x`, and the documented Docker Compose deployment publishes the backend's port to the host's `x.x.x.x` by default. Any network client that can reach that port has full, unauthenticated access to every endpoint, including reading and overwriting the stored LLM provider API key.

## Steps to reproduce

(available upon request)

## Impact

Any network client reaching a self-hosted instance can steal or replace the owner's LLM provider API key and read, modify, or delete all stored meeting transcripts and summaries, with no credentials of any kind.

## Suggested fix

Require an authentication mechanism (at minimum, a locally-generated shared secret set at first run, with every route requiring it) before the backend serves any business endpoint. Bind the backend to `127.0.0.1` by default rather than `x.x.x.x`, requiring an explicit opt-in (with a clear warning) to expose it beyond localhost, and never store provider API keys in a form retrievable without authentication.

• Источник: ⚠️ https://github.com/Zackriya-Solutions/meetily/issues/845
• Пользователь: carfeii (UID 97470)
• Представление: 18.10.2026 16:08 (25 дни назад)
• Модерация: 12.11.2026 18:51 (25 days later)
• Статус: принято
• Запись VulDB: 436458 [Zackriya-Solutions Meetily до 0.4.1 backend/app/main.py слабая аутентификация]
• Баллы: 20