CVE-2025-49652: BackendAI Missing Authentication for Critical Function

The vulnerability CVE-2025-49652, as described by NVD and detailed in the HiddenLayer security advisory, pertains to a missing authentication for a critical function in Lablup's BackendAI, specifically affecting the user registration feature. The HiddenLayer advisory is the primary source of technical detail, stating that the API endpoint /func/auth/signup can be exploited to create user accounts arbitrarily, even if the instance is configured to disallow new registrations. This allows attackers to gain unauthorized access.

To identify the vulnerable function, the following steps were taken:

1. Reviewed the vulnerability description and the HiddenLayer advisory, which pinpointed the /func/auth/signup endpoint as the entry point for the exploit.
2. Attempted to gather more specific code details using available tools, but direct file access to the repository via tools was unsuccessful due to credential issues, and no specific patch commits were provided.
3. Based on the typical structure of BackendAI (manually inferred by looking at the public GitHub repository lablup/backend.ai around the vulnerable version 25.3.3), API routes like /func/{service}/{operation} (e.g., /func/auth/signup) are handled by specific agent methods. The auth service and signup operation strongly point to a signup method within an authentication-related agent.
4. This led to identifying ai.backend.manager.auth.AuthAgent.signup located in src/ai/backend/manager/auth.py as the most probable function handling requests to the /func/auth/signup endpoint.
5. The vulnerability lies in this function's failure to adequately check whether user registration is permitted by the system's configuration before proceeding with account creation.

The confidence is 'Medium' because while the vulnerable endpoint is clearly identified by the advisory, the mapping to the specific Python function and method name relies on an understanding of the BackendAI framework's routing and code structure, rather than direct evidence from a patch diff. However, this function is the logical handler for the exploitable endpoint and the described vulnerable behavior (allowing signup when disabled).