SOURCE-LINKED INTELLIGENCE
GHSA-94f4-hr76-p5j6: vLLM: OpenAI auth bypass
### Summary A vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API `AuthenticationMiddleware`, which was discovered during @x41sec's source code audit. It allows to use the API without providing the configured `VLLM_API_KEY` or `--api-key`. ### Details In https://github.com/vllm-project/vllm/blob/v0.14.0/vllm/entrypoints/openai/api_server.py#L689-L692 the `url_path` is taken from the `URL`, which is reconstructed by _starlette_ based on the request `scope`. ```py from starlette.datastructures import URL, Headers, Mutabl
Read original source ↗ Open in workspace
- recordType
- vulnerability
- status
- active
- evidenceStatus
- reported
- region
- Global
Evidence & attribution
- OSV AI package advisories · 2026-06-16T17:36:41.000Z
- OSV AI package advisories · 2026-06-22T23:16:30.490Z
First collected: 2026-09-20T22:31:48.298Z. This is not the publication date.