-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| octoprint | pip | <= 1.10.3 | 1.11.0 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly named the vulnerable functions require_login, require_login_with, and require_fresh_login_with in octoprint/server/util/__init__.py. The provided commit patch confirms this by showing modifications to these exact functions. The patch removed the vulnerable logic that checked for the X-Preemptive-Recording HTTP header, which allowed bypassing authentication, and replaced it with a more secure check using a request context flag (g.preemptive_recording_active). The functions in src/octoprint/server/__init__.py and src/octoprint/server/views.py were modified to support this new mechanism and are part of the fix, not the vulnerability itself.
Ongoing coverage of React2Shell