Responsible Disclosure – Critical Security Vulnerability: Unauthenticated UID Access

[ghost]

Summary

This is a responsible disclosure of a critical backend vulnerability in Omi's API.

Description

Several sensitive endpoints are accessible without authentication by supplying a valid UID. A hardcoded UID (viUv7GtdoHXbK1UBCDlPuTDuPgJ3) exists in a public script, demonstrating how easily this could be exploited.

Affected Endpoints

• GET /v1/mcp/conversations
• GET /v1/mcp/memories
• POST /v1/mcp/memories
• DELETE /v1/mcp/memories/{memory_id}
• PATCH /v1/mcp/memories/{memory_id}
• POST /v1/mcp/users

Code References

• Vulnerable API router
• Hardcoded UID in script

Notes

Only a minimal, non-intrusive test was performed to validate the issue. No user data was stored or shared.

Recommendation

• All endpoints should enforce proper token-based authentication.
• Hardcoded UIDs should be removed from public code.

---

Suggested labels: bug, backend

[aaravgarg]

@krushnarout can u check if this is still an issue