Deepfiction AI Insecure Direct Object Reference Vulnerability Allowing Credit Misuse

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in Deepfiction AI's web application, through June 3, 2025. This vulnerability enables attackers to chat with the Large Language Model (LLM) using the credits of other users. The exploitation is possible by leveraging sensitive information obtained from the '/browse/stories' endpoint.

Impact

Exploitation of this vulnerability allows for unauthorized use of other users' chat credits, enabling attackers to interact with the LLM at the expense of the affected users.

Reproduction

The vulnerability can be reproduced by accessing publicly available conversations on the Deepfiction AI website, which expose 'id' and 'author_id' fields. These fields can be used to substitute the 'treatment_id' and 'user_id' parameters in requests to the 'create-story-part' API, thereby consuming the credits of other users.