GHSA-ww28-4m4v-cq4j

BackendAI Missing Authentication for Critical Function

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-49652

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	backend.ai	< 25.15.6	25.15.6
PyPI	backend.ai	>= 25.16.0rc1, < 25.19.0rc1	25.19.0rc1

Details

As written in the advisory (Markdown source, shown as plain text).

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-49652 advisory
https://github.com/lablup/backend.ai/commit/37fc8f70f9bad2dd01fe2e288f9006e96f9914ed web
https://github.com/lablup/backend.ai/commit/b6d3ddd9e285a7ce59722a37585b9298681eb82f web
https://github.com/lablup/backend.ai/commit/d7704f506e319acff205d91bfca6e2ca92939983 web
https://github.com/lablup/backend.ai package
https://github.com/pypa/advisory-database/tree/main/vulns/backend-ai/PYSEC-2026-290.yaml web
https://hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653 web
https://hiddenlayer.com/sai_security_advisor/2025-06-backendai web
https://pypi.org/project/backend-ai web