p PatchFirst

CVE-2025-49651

CVE-2025-49651 · Missing Authorization for Interactive Sessions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI.

CVSS 8.1 · High · EPSS 0.3%

Published
Updated

Stack: python

Affected products and versions

  • backendai

    Versions
    • *: Affected

    No fix published

  • backend-ai PyPI

    Versions
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 18.12.0
    • 19.3.0
    • 19.3.0a1
    • 19.9.0
    • 20.3.0
    • 20.3.1
    • 20.9.0
    • 20.9.0a1.dev0
    • 21.3.0
    • 22.3.0
    Affected ranges
    • ECOSYSTEM: ≤ 25.3.3

    No fix published

Original sources

Check your server →