Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wandb/openui

              main @ f9d8f0e
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

backend/openui/config.py: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: The application previously failed to write dynamically generated random session keys to disk, instead writing the literal string '{SESSION_KEY}'. This could result in predictable sessions or fallback to insecure defaults across instances. Additionally, CVE-2026-4993 highlights risks with hardcoded master keys in the same configuration file.

Auth Bypass: Local session assignment logic failed to correctly populate and return the local session identifier, leading to authentication bypass or session confusion bugs. This is compounded by unauthenticated file access vulnerabilities noted in CVE-2024-10649.

Cross-Site Scripting (XSS): The application suffers from multiple stored XSS vulnerabilities, notably in the window message event handlers, the HTML edit features, and the share creation/retrieval functions, allowing remote attackers to run arbitrary scripts via crafted payloads.