BackendAI Missing Authentication for Critical Function

CRITICAL 9.8CVE-2025-49652 · GHSA-ww28-4m4v-cq4j · PYSEC-2026-290 · Published 09/06/2025 · updated 14/10/2026

Package	Affected versions	Patched versions
backend-ai PyPI	`≥ 25.16.0rc1, < 25.19.0rc1< 25.15.6`	`25.19.0rc125.15.6`

Description

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

NVD description

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

References

nvd.nist.gov/vuln/detail/CVE-2025-49652 · ADVISORY
lablup/backend.ai commit 37fc8f7 · WEB
lablup/backend.ai commit b6d3ddd · WEB
lablup/backend.ai commit d7704f5 · WEB
lablup/backend.ai · PACKAGE
pypa/advisory-database · WEB
hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653 · WEB
hiddenlayer.com/sai_security_advisor/2025-06-backendai · WEB
pypi.org/project/backend-ai · WEB
hiddenlayer.com/sai_security_advisor/2025-06-backendai
GitHub Advisory GHSA-ww28-4m4v-cq4j · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free