Hi,
Found a missing authentication check on the custom model chat endpoint that allows cross-tenant API key usage.
Missing auth on custom model route
app/api/chat/custom/route.ts (lines 11-37) doesn't call getServerProfile() to authenticate the request. Every other chat route in the project does — I checked openai, anthropic, azure, google, groq, mistral, perplexity. All call getServerProfile() at the top. This one goes straight to fetching the model config.
The route uses SUPABASE_SERVICE_ROLE_KEY which bypasses Row Level Security. So an unauthenticated caller (or any authenticated user) can query any custom model by ID and the server will use that model owner's API key to make the LLM call.
Impact: Any user can burn another user's API credits or extract responses from their custom model configurations. In multi-tenant deployments this is a significant isolation breach.
Fix: Add the same getServerProfile() call at the top of the route handler, and scope the model lookup to the authenticated user's ID.
Reported by ProScan AppSec (https://proscan.one)
Hi,
Found a missing authentication check on the custom model chat endpoint that allows cross-tenant API key usage.
Missing auth on custom model route
app/api/chat/custom/route.ts(lines 11-37) doesn't callgetServerProfile()to authenticate the request. Every other chat route in the project does — I checked openai, anthropic, azure, google, groq, mistral, perplexity. All callgetServerProfile()at the top. This one goes straight to fetching the model config.The route uses
SUPABASE_SERVICE_ROLE_KEYwhich bypasses Row Level Security. So an unauthenticated caller (or any authenticated user) can query any custom model by ID and the server will use that model owner's API key to make the LLM call.Impact: Any user can burn another user's API credits or extract responses from their custom model configurations. In multi-tenant deployments this is a significant isolation breach.
Fix: Add the same
getServerProfile()call at the top of the route handler, and scope the model lookup to the authenticated user's ID.Reported by ProScan AppSec (https://proscan.one)