Jellyfish Ai Short Drama Studio
Monthly
Missing authentication in the FastAPI backend of Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha, 0.2.0, 0.3.0, 0.3.1 and 0.3.2) lets unauthenticated remote attackers reach API endpoints that should require credentials, because the dependency logic in backend/app/dependencies.py does not enforce an authentication check. The CVSS 4.0 base score is 6.9, and the vector (AV:N/AC:L/AT:N/PR:N/UI:N, LOW confidentiality/integrity/availability) indicates no credentials, no user interaction and no special conditions are needed; no public exploit code is identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status. Real-world priority remains low because the software is an obscure self-hosted hobby project, so exposure depends on someone operating a publicly reachable instance, and a successful bypass yields only LOW impact across all three security objectives.
Missing authentication in the FastAPI backend of Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha, 0.2.0, 0.3.0, 0.3.1 and 0.3.2) lets unauthenticated remote attackers reach API endpoints that should require credentials, because the dependency logic in backend/app/dependencies.py does not enforce an authentication check. The CVSS 4.0 base score is 6.9, and the vector (AV:N/AC:L/AT:N/PR:N/UI:N, LOW confidentiality/integrity/availability) indicates no credentials, no user interaction and no special conditions are needed; no public exploit code is identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status. Real-world priority remains low because the software is an obscure self-hosted hobby project, so exposure depends on someone operating a publicly reachable instance, and a successful bypass yields only LOW impact across all three security objectives.