Grok2Api
Monthly
Improper authorization in chenyme grok2api's video job retry handler allows a holder of a scope-restricted client key to reach accounts outside that key's configured AccountScope. In versions up to 3.1.6, when the account originally pinned to a video job fails and the retry path reselects a replacement, the key's ProviderScope/TierScope is not reapplied, so a key limited to free-tier or web-only accounts can consume a premium or console/build-only account's quota. Exploitation requires an authenticated client key that is configured with a restricted scope plus a triggered retry (CVSS v4 PR:L, CVSS 5.3); public exploit material has been disclosed with proof-of-concept maturity per the assessed vector, active exploitation is not confirmed, and version 3.1.7 resolves it.
Billing evasion in chenyme grok2api through 3.1.6 lets an authenticated client key with STT/voice capability avoid charges for audio the upstream provider has already transcribed, because the voice WebSocket handler only recorded billable usage when the session ended successfully. Exploitation is limited to deployments that actually meter and enforce billing on the voice STT path, requires a valid client key, and has no confidentiality or availability impact - the assessed impact is a low-integrity change to billed usage records. No public exploit code has been identified at time of analysis; the vendor-released patch is version 3.1.7 (commit 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4).
Idle voice/STT WebSocket sessions in chenyme grok2api up to 3.1.6 can be left open after the server's request timeout fires, holding the session, its upstream account lease, and a concurrency slot, which degrades availability for other users of the proxy. Triggering the condition requires a valid grok2api client key (PR:L) and access to the voice/STT WebSocket proxy path handled by proxyVoiceWebSocket in backend/internal/transport/http/inference/voice_ws_handler.go; impact is limited to availability (C:N/I:N/A:L, CVSS 5.3). Version 3.1.7 fixes the issue (commit 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4); no public exploit was identified at time of analysis and the vendor/priority signals place this in the this_month remediation bucket rather than an emergency.
Improper authorization in chenyme grok2api's video job retry handler allows a holder of a scope-restricted client key to reach accounts outside that key's configured AccountScope. In versions up to 3.1.6, when the account originally pinned to a video job fails and the retry path reselects a replacement, the key's ProviderScope/TierScope is not reapplied, so a key limited to free-tier or web-only accounts can consume a premium or console/build-only account's quota. Exploitation requires an authenticated client key that is configured with a restricted scope plus a triggered retry (CVSS v4 PR:L, CVSS 5.3); public exploit material has been disclosed with proof-of-concept maturity per the assessed vector, active exploitation is not confirmed, and version 3.1.7 resolves it.
Billing evasion in chenyme grok2api through 3.1.6 lets an authenticated client key with STT/voice capability avoid charges for audio the upstream provider has already transcribed, because the voice WebSocket handler only recorded billable usage when the session ended successfully. Exploitation is limited to deployments that actually meter and enforce billing on the voice STT path, requires a valid client key, and has no confidentiality or availability impact - the assessed impact is a low-integrity change to billed usage records. No public exploit code has been identified at time of analysis; the vendor-released patch is version 3.1.7 (commit 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4).
Idle voice/STT WebSocket sessions in chenyme grok2api up to 3.1.6 can be left open after the server's request timeout fires, holding the session, its upstream account lease, and a concurrency slot, which degrades availability for other users of the proxy. Triggering the condition requires a valid grok2api client key (PR:L) and access to the voice/STT WebSocket proxy path handled by proxyVoiceWebSocket in backend/internal/transport/http/inference/voice_ws_handler.go; impact is limited to availability (C:N/I:N/A:L, CVSS 5.3). Version 3.1.7 fixes the issue (commit 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4); no public exploit was identified at time of analysis and the vendor/priority signals place this in the this_month remediation bucket rather than an emergency.