HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that…

What to know

What it is

HKUDS Vibe-Trading versions 0.1.0 to 0.1.7 contain a missing authentication vulnerability, allowing unauthenticated attackers to access the FastAPI surface and perform various actions.

Affected

{'products': ['HKUDS Vibe-Trading'], 'packages': [], 'versions': ['0.1.0', '0.1.1', '0.1.2', '0.1.3', '0.1.4', '0.1.5', '0.1.6', '0.1.7']}

Fix

Check the linked advisory for the concrete fix; upgrade target versions

Exploitation

No known exploitation

Not confirmed. 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6 isn't in the advisory. Check the vendor's advisory before acting on this.