November 11, 2026 · 2 min read
An AI startup, , had a public playground where you paste your API key and ask questions about your data. One unauthenticated request let us change where that playground sent everything, for every user.
Found together with @javoriuski.
You open the playground and enter your API key. It's saved in your browser's
localStorage and sent to the playground backend with every request. The
backend then calls the real API for you.
The backend gets the API address from its config, at /config on
.
/config had no authentication, and it didn't store settings per user. It
stored them for the whole deployment. So this request changed the API address
for everyone:
From then on, every request from every user went to our server first.
When someone enters their API key, the playground checks the connection by sending the key to the API address. That's now our server.
The check fails, but it doesn't matter. We already have the key.
This part is worse. Users who already set up their key don't need to enter it
again, and every question they ask goes to /ask with their tenant IDs and API
key. That now means our server.
We log it all and forward the request to the real API. The answer comes back normally, so the user sees nothing wrong. We get the full conversation and their key.
A settings page with no login turned the playground into a man-in-the-middle for all its users. A config endpoint that changes things for everyone needs to be behind admin auth, or it shouldn't be public at all.
We reported it, and it paid a $5,000 bounty.