grok2api EUVD-2026-118509

Requires a valid authenticated client key with STT/voice capability enabled (PR:L) and a deployment actively using the voice WebSocket STT billing path. The specific trigger per the PR diff: the attacker lets the upstream emit a transcript.done with a positive AudioDurationSeconds, then disconnects so the session outcome is 'client_stream_interrupted' (successfulfalse); pre-3.1.7 code only billed when successfultrue AND operation==STT, so confirmed usage was dropped. Limiting factors: exploitation only matters on metered/multi-tenant hosted instances where billing is enforced, needs an existing authenticated key, and is confined to STT voice sessions - it does not affect other endpoints and has no confidentiality or availability impact.

This is a medium-severity integrity/billing-evasion flaw, not a confidentiality issue despite the 'Information Disclosure' tag. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) is internally consistent with the source evidence: network-reachable, low complexity, requires a valid authenticated client key (PR:L), and produces only a limited integrity impact (VI:L) with no confidentiality or availability impact - matching the PR diff, which shows STT usage not being recorded when a client disconnects after a confirmed transcript duration. No EPSS score, SSVC automatable/technical-impact values, or CISA KEV status were provided, and no public exploit reference is present (only the vendor issue, PR, commit, and release). The vuln.today decision label is 'this_month', which aligns with a real-but-non-urgent fix priority rather than act_now/emergency. Net: a genuine abuse-of-service / revenue-leakage bug that authenticated users of a hosted grok2api instance can trigger, but it is self-serving billing evasion rather than a broadly dangerous RCE or data-exposure issue. The only notable metadata conflict is the 'Information Disclosure' tag, which is contradicted by VC:N in the vendor-supplied vector and by the billing-logic nature of the patch.

An authenticated client of a hosted grok2api deployment (PR:L) opens an STT voice WebSocket, sends audio, and waits for the upstream transcript.done event that confirms a billable AudioDurationSeconds. The client then abruptly interrupts the connection before a clean close so the session outcome is marked unsuccessful (client_stream_interrupted); in versions up to 3.1.6 the billing branch required successful==true, so the already-incurred STT cost was never charged, letting the user consume transcription service for free. No public exploit identified at time of analysis, but the PR includes regression tests that demonstrate the exact billing-skip behavior.