AIKIDO-2026-10917

TL;DR

Affected versions of this package contain an unauthenticated authorization bypass in the public jobs_u/getupdate/{id} and jobs_u/getupdate_sse/{id} endpoints when only_result=true is supplied, allowing unauthenticated users who know a private job UUID to retrieve job output that may include sensitive user data, third-party API responses, or secrets. An attacker could exploit this by obtaining or guessing a valid private job ID and sending an unauthenticated request to the affected endpoint with only_result=true to access results that should only be available to authorized users.