CyberRota Analysis
AI-GeneratedThe vulnerability affects the Sub2API platform, allowing authenticated tenants to exploit improperly validated API keys to relay requests to arbitrary upstream endpoints, leveraging shared provider accounts. This poses a significant risk as it can lead to unauthorized access and data exposure through pooled account credentials. Organizations using versions 0.1.135 to 0.1.168 of Sub2API should prioritize immediate updates to version 0.1.169 to mitigate this high-severity security issue.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts (ChatGPT/Codex OAuth, OpenAI platform keys, or an operator-configured base URL) that belong to the operator, not to the caller. The `POST /responses/*subpath` wildcard routes spliced the client-supplied subpath into the upstream URL with no validation. This lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials via a path traversal. This vulnerability is fixed in 0.1.169.