Executive brief
Jellyfish AI Short Drama Studio is a tool for creating AI-generated short drama videos. The application fails to enforce authentication on its API endpoints, allowing unauthenticated attackers to read, modify, and delete projects, upload files, change LLM provider credentials, and trigger generation tasks. An attacker with network access can fully compromise the application's data and functionality without any credentials.
Technical details
The FastAPI application defines only get_db and get_llm dependencies without any authentication or authorization logic in backend/app/dependencies.py, and all v1 routes are mounted without authentication middleware. An unauthenticated remote attacker can invoke all API endpoints (backend/app/api/v1/routes/*) to access and modify sensitive data including projects, files, LLM provider credentials, and trigger generation tasks. No authentication fix has been confirmed in a patch.
Affected products
- Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha, 0.2.0, 0.3.0, 0.3.1, 0.3.2
Timeline
- 2026-08-23: disclosed: GitHub issue #37 opened
- 2026-09-18: advisory: CVE-2026-93559 published