Hijacking a Playground with One Request

An unauthenticated request to an AI startup's public playground /config endpoint let researchers change the API address for the entire deployment, turning the playground into a man-in-the-middle that captured every user's API key and full conversation, the researchers reported. Because /config stored settings per deployment rather than per user, all traffic from all users was routed to the researchers' server, which logged the keys and forwarded requests to the real API so users saw nothing wrong. The company paid a $5,000 bounty after the researchers reported the flaw, which they said requires admin authentication on any config endpoint that changes settings for everyone.

November 11, 2026 · 2 min read An AI startup, , had a public playground where you paste your API key and ask questions about your data. One unauthenticated request let us change where that playground sent everything, for every user. Found together with @javoriuski https://x.com/javoriuski . You open the playground and enter your API key. It's saved in your browser's localStorage and sent to the playground backend with every request. The backend then calls the real API for you. The backend gets the API address from its config, at /config on . /config had no authentication, and it didn't store settings per user. It stored them for the whole deployment. So this request changed the API address for everyone: From then on, every request from every user went to our server first. When someone enters their API key, the playground checks the connection by sending the key to the API address. That's now our server. The check fails, but it doesn't matter. We already have the key. This part is worse. Users who already set up their key don't need to enter it again, and every question they ask goes to /ask with their tenant IDs and API key. That now means our server. We log it all and forward the request to the real API. The answer comes back normally, so the user sees nothing wrong. We get the full conversation and their key. A settings page with no login turned the playground into a man-in-the-middle for all its users. A config endpoint that changes things for everyone needs to be behind admin auth, or it shouldn't be public at all. We reported it, and it paid a $5,000 bounty.