Auth bypass in Kunchenguid Lavish-Axi
CVE-2026-102344
Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.
Published .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Kunchenguid Lavish-Axi — versions < 0.1.43
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-102344?
- CVE-2026-102344 is a high-severity vulnerability in Kunchenguid Lavish-Axi, classified under External Control of File Name or Path. CVSS score: 8.1/10. Published 2026-11-06.
- How severe is CVE-2026-102344?
- High severity. CVSS v3 base score is 8.1 out of 10.