CVE-2026-45567 Details

An authentication bypass vulnerability has been identified in Roxy-WI versions through 8.2.6.4. The issue arises from the global 'before_request' hook, which skips authentication for any URL containing the substring 'api', including the query string. This flaw allows unauthenticated access to the '/api/gpt' endpoint, registered directly on the main application without proper authentication decorators. As a result, an attacker can reach the handler without authentication, potentially leading to unauthorized use of resources and exposure of sensitive information.

To address this vulnerability, replace the substring check in the 'before_request' hook with an explicit allowlist of public endpoints. Additionally, add the 'jwt_required' decorator to the '/api/gpt' endpoint or move it to the API blueprint where authentication is already managed.