FastGPT contains a flaw in its plugin invoke reverse‑call endpoints where authentication is performed solely by verifying a JSON Web Token signed with the server‑side secret INVOKE_TOKEN_SECRET. The default value for this secret is the constant string "token", and the deployment templates do not set a unique value. Consequently, an unauthenticated attacker can forge an HS256 signed JWT and access endpoints such as /api/invoke/userInfo to retrieve personal identifying information or /api/invoke/fileUpload to write attacker‑controlled content into chat files. This constitutes a severe data exposure and integrity violation and is identified as a CWE‑798 weakness.

The vulnerability applies to FastGPT version 4.15.0‑beta4, as released by labring. The issue was addressed in release 4.15.0‑beta5, which incorporates stricter authentication checks for the invoke endpoints.

The CVSS score of 8.8 reflects a high‑severity vulnerability. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild today, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is straightforward: an attacker who can reach the FastGPT API can self‑sign a JWT using the known default secret and supply arbitrary tenant identifiers to obtain data or upload files, without any authentication or privileged credentials.