Agent Teams Ai
Monthly
Missing authentication on the local HTTP service in 777genius agent-teams-ai through 2.17.10 allows a locally positioned attacker with existing low privileges to access service endpoints without credentials, yielding low-impact confidentiality disclosure. The service is started by doStart in HttpServer.ts and is reachable only with local access; remote exploitation is not possible per the assessed vector, and integrity and availability impacts are absent. A public PoC reference exists but is not verified as working exploit code, and no vendor patch or response is identified; priority is monitor.
Missing authentication on the local HTTP service in 777genius agent-teams-ai through 2.17.10 allows a locally positioned attacker with existing low privileges to access service endpoints without credentials, yielding low-impact confidentiality disclosure. The service is started by doStart in HttpServer.ts and is reachable only with local access; remote exploitation is not possible per the assessed vector, and integrity and availability impacts are absent. A public PoC reference exists but is not verified as working exploit code, and no vendor patch or response is identified; priority is monitor.