EUVD-2026-20625
GHSA-q8cg-hw7c-28qg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
7DescriptionCVE.org
A security flaw has been discovered in bigsk1 openai-realtime-ui up to 188ccde27fdf3d8fab8da81f3893468f53b2797c. The affected element is an unknown function of the file server.js of the component API Proxy Endpoint. Performing a manipulation of the argument Query results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is named 54f8f50f43af97c334a881af7b021e84b5b8310f. It is suggested to install a patch to address this issue.
AnalysisAI
Server-side request forgery (SSRF) in bigsk1 openai-realtime-ui allows authenticated remote attackers to manipulate API proxy endpoint query parameters in server.js, enabling the server to make arbitrary requests to internal or external resources. The vulnerability affects all versions up to commit 188ccde27fdf3d8fab8da81f3893468f53b2797c, has publicly available exploit code, and carries a CVSS 5.3 score reflecting moderate impact with authentication required. A fix is available via commit 54f8f50f43af97c334a881af7b021e84b5b8310f.
Technical ContextAI
The vulnerability exists in the API proxy endpoint implementation within server.js, where user-supplied query parameters are passed to backend HTTP requests without proper validation or sanitization. This is a classic CWE-918 (Server-Side Request Forgery) flaw where the server acts as a proxy for client requests without restricting the destination. The bigsk1 openai-realtime-ui project uses continuous delivery with rolling releases rather than semantic versioning, meaning affected versions are identified by commit hash rather than release version numbers. The issue manifests in the proxy layer that likely forwards user requests to the OpenAI Realtime API or other backend services, allowing attackers to pivot those requests toward arbitrary targets.
RemediationAI
Organizations using bigsk1 openai-realtime-ui should immediately update to a commit at or after 54f8f50f43af97c334a881af7b021e84b5b8310f, which includes the upstream fix. Since the project uses continuous delivery, the recommended approach is to pull the latest main branch or redeploy from the patched commit hash. The fix is available via the upstream pull request (https://github.com/bigsk1/openai-realtime-ui/pull/2) and the commit directly (https://github.com/bigsk1/openai-realtime-ui/commit/54f8f50f43af97c334a881af7b021e84b5b8310f). As an interim workaround pending deployment, implement strict validation and allowlisting of query parameters in the API proxy endpoint to reject any requests targeting non-whitelisted backend services or internal IP ranges. Review proxy logs at the affected commit range for evidence of malicious query parameter abuse. For environments where upgrading immediately is not feasible, restrict network access from the application server to only necessary external endpoints using firewall rules or network policies.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today