A flaw in the beginSelectionSession function of the Video Job Retry Handler permits an attacker to invoke the API without proper credentials, resulting in unauthorized execution of video processing jobs. The weakness is associated with CWE‑266 and CWE‑285, indicating that sensitive functions are accessible without appropriate role checks. This can lead to data exposure or manipulation of video job queues.

The vulnerability affects the chenyme grok2api product, specifically versions up to and including 3.1.6. Users running any of these releases are susceptible until they upgrade to version 3.1.7, which contains a patch based on commit 199b3abecc14907176dae1f1cacf125419caa94d.

The CVSS score of 5.3 reflects moderate severity and indicates that the flaw can be leveraged remotely. EPSS information is not available, and the issue is not listed in the CISA KEV catalog, but publicly disclosed exploits exist that can be abused to bypass authorization controls. Attackers would need network access to the API and can trigger unauthorized job submissions, potentially leading to data tampering or service disruption.