CyberRota Analysis
AI-GeneratedThe vulnerability affects GPT-Load versions up to 1.4.11, where the Gin Logger middleware logs raw query strings, inadvertently exposing client proxy keys. This could allow attackers with access to console logs to retrieve sensitive proxy keys and potentially exploit them against the associated group. Organizations utilizing GPT-Load should prioritize addressing this issue to mitigate the risk of unauthorized access to their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.