[GHSA-ww28-4m4v-cq4j] BackendAI Missing Authentication for Critical Function

[Yaminyam]

Updates

• Affected products

Comments
This was caused by a missing status check/setting in our signup workflow implementation.

The fix is implemented and will be included in the upcoming release (v25.19) as follows:
lablup/backend.ai#7520

Thanks for reporting this issue, because we did not find it an issue as most production deployment is done in air-gapped clusters or private infrastructures.

[Copilot]

Pull request overview

This pull request updates the security advisory for BackendAI's missing authentication vulnerability (GHSA-ww28-4m4v-cq4j) to reflect that a fix has been released in version 25.19.0.

Changes:

• Updated vulnerability status from "last_affected" to "fixed" version
• Added database_specific metadata to document the last known affected version range

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shelbyc]

Hi @Yaminyam, I see that the fix has been backported to 25.15.6 (lablup/backend.ai@d7704f5) as well as version 25.19.0rc1. There's a fix on the 25.8 branch (lablup/backend.ai@37fc8f7) but it doesn't correspond to a numbered release, so I'll leave the fixed versions as 25.15.6 and 25.19.0rc1 for now.

[advisory-database]

Hi @Yaminyam! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!