Authentication Bypass in gaizhenbiao/ChuanhuChatGPT

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secure source like a cookie. This allows an attacker to pass another user's username to the get_model function, thereby gaining unauthorized access to that user's chat history.

N/A

认证中关键步骤缺失

ChuanhuChatGPT 安全漏洞

ChuanhuChatGPT是Chuan Hu个人开发者的一款应用程序。为 ChatGPT 等多种 LLM 提供了一个轻快好用的 Web 图形界面和众多附加功能 ChuanhuChatGPT 3856d4f版本存在安全漏洞，该漏洞源于用户名通过客户端HTTP请求提供，可能导致身份验证绕过，读取和删除其他用户的聊天记录。

N/A

N/A