Executive brief
Stable Diffusion WebUI, a popular open-source interface for AI image generation, exposes configured usernames and passwords through an unauthenticated API endpoint. An attacker can retrieve these credentials without authentication and use them to gain full access to the application, allowing them to run unauthorized image generation jobs or modify system settings.
Technical details
The /sdapi/v1/cmd-flags endpoint in Stable Diffusion WebUI through version 1.10.1 returns parsed command-line arguments including gradio_auth and api_auth credentials in cleartext without requiring authentication. The vulnerability exists in the API's credential handling logic and allows any network-accessible attacker to retrieve configured usernames and passwords by making an HTTP GET request to the endpoint. Once obtained, these credentials can be used to authenticate to the web interface or API, granting the attacker full application access. This is a direct information disclosure vulnerability with no special preconditions beyond network reachability.
Affected products
- AUTOMATIC1111 Stable Diffusion WebUI through 1.10.1
Timeline
- 2026-08-28: disclosed