Description

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custom_auth_handler.py. The manipulation of the argument user_id leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T19:16:53.517Z",
  "pubdate": "2026-09-13T19:16:53.517Z",
  "executiveSummary": "A critical authentication bypass vulnerability exists in Cheshire Cat AI up to version 1.9.2, stemming from improper validation within the authentication handling logic.\nThe vulnerability resides in the _authorize_http_key function located within core/cat/factory/custom_auth_handler.py, where the user_id parameter is insufficiently sanitized or validated.\nSuccessful exploitation allows an unauthenticated remote attacker to bypass identity verification mechanisms, potentially gaining unauthorized access to the application’s administrative or user-specific functionalities.\nThis flaw represents a significant security risk, as it permits full system interaction without valid credentials, undermining the integrity and confidentiality of the entire deployment.\nAs the project maintainers have not yet responded to disclosure, deployments remain in an exposed state. Exploitation requires only network-level access to the application, and the availability of public exploit material increases the likelihood of malicious activity.",
  "technicalDetails": "The vulnerability is localized to the _authorize_http_key function, which is responsible for processing incoming HTTP requests and validating authentication tokens or keys.\nThe root cause is an improper trust model applied to the user_id argument passed to the authentication handler. The function fails to perform cryptographic verification or sufficient input sanitization on this identifier before granting the request context.\nDuring the request lifecycle, the application relies on the provided user_id to resolve user authorization levels. An attacker can manipulate this parameter to inject arbitrary identifiers, tricking the authorization logic into mapping the request to a privileged user or bypassing the check entirely.\nThe attack flow begins when an attacker sends a crafted HTTP request to the target system. By bypassing the expected authentication headers and providing a malicious or forged user_id, the attacker exploits the lack of server-side validation in core/cat/factory/custom_auth_handler.py.\nBecause the function fails to verify the authenticity of the request origin against the provided ID, the application’s factory logic treats the request as legitimate. This grants the attacker an authenticated session context without any prior password or token exchange.\nThe vulnerable component, custom_auth_handler.py, serves as a gatekeeper for API operations. By subverting this component, an attacker can invoke backend functions, modify application data, or access sensitive memory and resources managed by the Cheshire Cat AI framework.\nExploitation is possible remotely over the network, requiring no specific user interaction or pre-existing account status. The lack of cryptographic binding between the request source and the user_id makes this a high-severity flaw.\nThe impact post-exploitation includes unauthorized data exfiltration, system configuration modification, and potentially remote code execution if the application's underlying logic allows for plugin manipulation via the authenticated API surface."
}