OpenCode Studio <= 2.4.3 Missing Authentication Vulnerability Early Warning
OpenCode Studio versions prior to 2.4.4 are under investigation for a critical missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files and delete videos.
What happened
OpenCode Studio versions before 2.4.4 reportedly contain a vulnerability (CVE-2026-69110) that enables unauthenticated remote attackers to access arbitrary files within the temp and static/music directories. This can be achieved by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers may retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs. Additionally, attackers can delete any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint.
The vulnerability has been assigned a CVSS score of 9.1, indicating a critical severity level. It is recommended that users upgrade to OpenCode Studio 2.4.4 or later to mitigate this risk. Additionally, any secrets in affected environments should be rotated as a precautionary measure.
For more detailed information, please consult the primary sources listed. The incident is still under investigation, and further details may emerge as the situation develops.
How 0Day mitigates this
opencode studio is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.