HI-SA-2026-002 High Published Vulnerability
Access control not enforced in ai-openrouter-gateway
andrecorugda/ai-openrouter-gateway documents a setting that decides who may reach the AI gateway admin. The code never read that setting. Any signed-in user of the Filament panel could create API tokens, change system prompts and models, and read every prompt and response. Whoever used the setting got no sign that it did nothing. The maintainer fixed it within a day in 1.3.3 and 2.0.3.
Who it affects
- Sites with a Filament panel running andrecorugda/ai-openrouter-gateway below 1.3.3, or 2.0.0 up to 2.0.3
- Panels with more users than just admins
- Applications that followed the documentation and assumed access was restricted
How to fix it
composer update andrecorugda/ai-openrouter-gateway
Update to 1.3.3 (Filament 3) or 2.0.3 (Filament 4 and 5). There every page and part of the gateway checks the configured access rule. Then check which API tokens exist and revoke any not created by admins. Also check that system prompts and model settings are still right.
Timeline
- Vulnerability found and confirmed in a test environment
- Reported privately to the maintainer through GitHub 0 days
- Maintainer confirmed and fixed it in 1.3.3 and 2.0.3, crediting HackIndex as finder 1 day
- Advisory GHSA-57hh-5c98-83r8 published, CVE requested 2 days
References
About this report
HackIndex does pentests and code review, and researches open-source packages, plugins and extensions. A vulnerability goes to the maker first, malware straight to the platform that spreads it.
Questions about this report or a correction? Mail info [at] hackindex [dot] nl with HI‑SA‑2026‑002 in the subject.
You may reuse this report under CC BY 4.0 (opens in a new tab), with the reference and this URL as source.
Why HackIndex does research Deadlines and agreements About HackIndex
Have it checked
Flaws like this often sit in the way an app uses a package. A security code review looks at that on purpose.