| Title | volotat Anagnorisis 0.4.0 Missing Authentication |
|---|
| Description | A missing authentication vulnerability exists in the Socket.IO interface of volotat Anagnorisis 0.4.0. The product enables HTTP Basic Authentication when ANAGNORISIS_USERNAME and ANAGNORISIS_PASSWORD are configured and applies it through a Flask before_request hook. The Socket.IO connect handler and subsequent Socket.IO events do not enforce the configured credentials.
In an isolated loopback reproduction using commit acce76065cd4cecf6eaed5bee8691e95c85964d4, an unauthenticated HTTP request returned 401 while a Socket.IO client without credentials connected successfully and invoked the read-only task_manager_get_state event. The response exposed the active, history, queued and schedulers state keys. Other registered events perform database import, configuration, media-library and model-training operations.
The root cause is an inconsistent authentication boundary between Flask HTTP requests and Socket.IO connections. The wildcard Socket.IO Origin policy increases browser reachability but is treated as a secondary hardening issue rather than a separate vulnerability.
|
|---|
| Source | ⚠️ https://note-hxlab.wetolink.com/share/y74Vzt1jfkAi |
|---|
| User | hiro (UID 93548) |
|---|
| Submission | 07/29/2026 02:25 (2 months ago) |
|---|
| Moderation | 09/24/2026 12:12 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 409321 [volotat Anagnorisis up to 0.3.1/0.4.0 Socket.IO Connect Interface app.py missing authentication] |
|---|
| Points | 20 |
|---|