The vulnerability exists in the /sdapi/v1/cmd-flags API endpoint of Stable Diffusion WebUI. It returns parsed command-line arguments in cleartext, including the gradio_auth and api_auth values that store the usernames and passwords set for the web interface. An attacker who can reach this endpoint without any authentication can read these credentials. Once the credentials are known, the attacker can log in to the web interface and obtain full access to the application, potentially allowing further exploitation of the installed environment. This constitutes a serious confidentiality compromise rooted in an information disclosure flaw (CWE-522).

The issue affects AUTOMATIC1111 Stable Diffusion WebUI version 1.10.1 and earlier. Users running this version are at risk of having their authentication secrets exposed via the exposed /sdapi/v1/cmd-flags endpoint. No other product or version is currently known to be vulnerable.

The CVSS score of 8.7 reflects a high risk of credential leakage, and because the flaw is exploitable without authentication, the attack vector is network‑based and likely public. The EPSS score is not available, but the lack of a KEV listing does not reduce the likelihood that an attacker could discover and exploit the endpoint. In practice, any system that exposes the API to an untrusted network or the public internet can be compromised by simply sending an HTTP request to /sdapi/v1/cmd-flags and parsing the returned JSON. The rapid nature of this exploitation means that an attacker can obtain valid credentials almost immediately after discovering the vulnerability, thereby gaining full access to the web UI and any downstream services it controls.