Critical Auth Flaw Found in OpenCode Studio

OpenCode Studio versions before 2.4.4 are affected by a critical missing authentication vulnerability, tracked as CVE-2026-69110. This flaw allows unauthenticated remote attackers to bypass security checks and access sensitive data or perform unauthorized destructive actions within the application.

What's at Risk

The vulnerability impacts any deployment of OpenCode Studio versions 2.4.3 and earlier. Organizations running these versions in internet-facing environments are at the highest level of risk, as the endpoints are reachable without any requirement for valid user credentials.

Because the flaw affects both data retrieval and file management, it puts any user data stored within the system at risk. This includes sensitive intermediate audio and video artifacts, as well as subtitles associated with other users' projects.

How the Flaw Works

A missing authentication vulnerability occurs when a web application fails to verify the identity of the user before providing access to a resource or functional endpoint. In general terms, this class of weakness allows unauthorized actors to interact directly with internal APIs that should be restricted to authenticated sessions.

When an application lacks these checks, it effectively treats every incoming request as if it originated from a trusted, logged-in user. Attackers can leverage this to perform actions such as arbitrary file retrieval or unauthorized administrative tasks, such as deleting records or modifying system state, simply by sending specifically crafted requests to the exposed endpoints.

How to Protect Your Systems

• Update OpenCode Studio to version 2.4.4 or later immediately to resolve the missing authentication flaw.
• Restrict access to the application's API endpoints at the network level if an immediate upgrade is not possible.
• Implement network segmentation to isolate the server hosting OpenCode Studio from critical internal infrastructure.
• Monitor server access logs for anomalous GET requests to the /api/tmp/ and /api/music/ paths or DELETE requests to /api/short-video/.
• Conduct a review of file permissions and stored data to ensure no sensitive information was exposed prior to the patch.

With a CVSS 3.1 score of 9.1, this vulnerability is classified as critical due to the ease of exploitation and the significant impact on both data confidentiality and integrity. Promptly applying the vendor's security update is the only effective way to fully remediate the risk posed by this unauthorized access vector.