AIKIDO-2026-965314

TL;DR

OpenC3::AuthModel.verify_no_service uses Store.hgetall(SESSIONS_KEY) when a supplied token is missing from the short lived in memory cache, and loads every active session from Redis on that request. The method accepts any string as a token, so an unauthenticated caller can send bogus Authorization values or session check requests and force a full session table scan on each miss, with cost growing as sessions accumulate, which can exhaust Redis and API resources and degrade authentication for legitimate users. The fix uses HGET for a single field instead of HGETALL, and the unauthenticated session check endpoint rejects tokens that are not shaped like SESSION_PREFIX plus a fixed length identifier before calling into Redis.