AIKIDO-2025-10485

TL;DR

Affected versions of this package are vulnerable to Authentication Bypass via unprotected static file endpoint due to improper access controls when serving static directories via the --static-dirs flag. Attackers can exploit this by accessing direct URLs without OAuth authentication, enabling unauthorized file downloads. It occurs because the static file endpoint lacks authentication checks, exposing all files in the designated directory to unauthenticated users.