UpTrain vulnerabilities were discovered in version 0.7.1 and earlier where a static username is generated as a default API key for the system. This key is sent to the backend as the bearer token in the uptrain-access-token header. A flaw in the application logic combined with an unrestricted CORS policy allows a malicious website to send authenticated requests to any deployed instance and perform actions with the privileges of the default user. The weakness is catalogued as a broken authentication mechanism, specifically CWE-287, allowing an attacker to impersonate a legitimate user or elevate privileges without proper credential validation.

The affected product is UpTrain (uptrain-ai:uptrain) version 0.7.1 and all prior releases. No other versions or extensions are documented in the advisory, and no patches have been released at the time of publication.

The CVSS score of 7.7 marks this flaw as high severity. The EPSS score is not available, but the lack of a KEV listing does not preclude exploitation. Based on the description, it is inferred that the likely attack vector involves a malicious website crafting cross‑origin requests that include the default API key in the uptrain-access-token header, exploiting the open CORS policy to authenticate as the default user. This allows the attacker to perform privileged operations with unrestricted access, leading to significant risk to confidentiality, integrity, and availability, especially for publicly exposed or shared environments.