Auth bypass in Kunchenguid Lavish-Axi
CVE-2026-102344
Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.
Published .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.002 (4.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 4.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Kunchenguid Lavish-Axi — versions < 0.1.43
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-102344?
- CVE-2026-102344 is a high-severity vulnerability in Kunchenguid Lavish-Axi, classified under External Control of File Name or Path. CVSS score: 8.1/10. Published 2026-11-06.
- How severe is CVE-2026-102344?
- High severity. CVSS v3 base score is 8.1 out of 10.