gaizhenbiao ChuanhuChatGPT Authentication Bypass Vulnerability Allowing Unauthorized Access to Chat History

An authentication bypass vulnerability has been identified in gaizhenbiao ChuanhuChatGPT, as of commit 3856d4f. This vulnerability allows any user to read and delete other users' chat history. The issue arises because usernames are sent via HTTP requests from the client side, instead of being securely sourced from cookies. This flaw enables an attacker to manipulate the username parameter and access another user's chat history through the get_model function.

Impact

Exploitation of this vulnerability allows for unauthorized reading and deletion of users' chat history.