Starting with version 0.1.0, HKUDS Vibe‑Trading’s FastAPI server has a missing authentication check that allows any unauthenticated user to reach protected endpoints. The API endpoint /sessions/{id}/messages can be used to run arbitrary Bash commands via BashTool, while /upload permits uploading .py or .sh files. Attackers can also read session histories and retrieve partial API keys, giving them a foothold for further exploitation. The flaw is a classic "missing authentication" weakness (CWE‑306).

The vulnerability affects the HKUDS Vibe‑Trading product in all releases from 0.1.0 up to, but not including, 0.1.7. Users running any of those versions on their own servers are susceptible to the described exploits.

With a CVSS score of 9.3 the vulnerability is high severity, yet the EPSS score is listed as less than 1 % indicating a low current probability of exploitation. The flaw is not present in the CISA KEV catalog. The most likely attack vector is unauthenticated remote access over the network to the FastAPI interface, where an attacker can trigger commands, upload malicious scripts, or retrieve session data. Mitigation is required immediately to prevent potential compromise of the host system.