serge-chat Missing Authentication for Critical Function (CVE-306)

Vulnerability Overview CVE ID: CVE-306 (VulDB #791089) Vulnerability Name: serge-chat serge <= 3cb250c Missing Authentication for Critical Function Vulnerability Type: Missing Authentication for Critical Function Severity: High Detailed Description: Prior to commit in , six endpoints in were vulnerable due to missing authentication. Although commit added authentication to , this commit was never merged or deployed, leaving all endpoints completely unprotected. Any unauthenticated remote attacker can trigger model downloads, delete installed models, or cancel legitimate downloads. Affected Scope: Affected Component: (commit 3cb250c and earlier versions) Affected Endpoints: All six endpoints in (including , , etc.). Specific Impacts: 1. Enumeration: An attacker can enumerate all 63 available models. 2. Model Download: An attacker can download all 63 models, leading to disk and bandwidth consumption. 3. Model Deletion: An attacker can delete installed models. 4. Disk Exhaustion: An attacker can trigger simultaneous downloads of all 63 models (~1.4TB), resulting in disk exhaustion. 5. Service Disruption: An attacker can cancel legitimate user downloads, causing service interruption. Remediation: Upgrade to a version of that includes commit or later. This version adds authentication to . PoC Code**:

Goal Reached Thanks to every supporter — we hit 100%!

serge-chat Missing Authentication for Critical Function (CVE-306)