Open-source package vulnerability · PyPI
CVE-2025-49652: BackendAI Missing Authentication for Critical Function
criticalCVSS 3.1 9.8GHSA-ww28-4m4v-cq4j
Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
Published Jun 9, 2025 · Updated Jan 20, 2026
Affected packages
backend.ai
- Ecosystem
- PyPI
- Affected
- < 25.15.6
- Fixed in
- 25.15.6
- Check
pip show backend.ai
backend.ai
- Ecosystem
- PyPI
- Affected
- >= 25.16.0rc1, < 25.19.0rc1
- Fixed in
- 25.19.0rc1
- Check
pip show backend.ai
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
Credited to Yaminyam.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-49652
- https://hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653
- https://hiddenlayer.com/sai_security_advisor/2025-06-backendai
- https://github.com/lablup/backend.ai/commit/37fc8f70f9bad2dd01fe2e288f9006e96f9914ed
- https://github.com/lablup/backend.ai/commit/b6d3ddd9e285a7ce59722a37585b9298681eb82f
- https://github.com/lablup/backend.ai/commit/d7704f506e319acff205d91bfca6e2ca92939983
- https://github.com/advisories/GHSA-ww28-4m4v-cq4j
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology