# GHSA-xfqj-r5qw-8g4j: Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode

> Unauthenticated access to API endpoints allows attackers to read sensitive data and generate valid API keys without credentials.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 16 Apr 2026

## What is GHSA-xfqj-r5qw-8g4j?

GHSA-xfqj-r5qw-8g4j is a missing authorization vulnerability in @paperclipai/server, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

## Summary

Several API endpoints in `authenticated` mode have no authentication at all. They respond to completely unauthenticated requests with sensitive data or allow state-changing operations. No account, no session, no API key needed.

Verified against the latest version.

Discord: sagi03581

## Steps to Reproduce

### 1. Unauthenticated issue data access

`GET /api/heartbeat-runs/:runId/issues` returns issue data for a heartbeat run with zero authentication. Every other endpoint in `server/src/routes/activity.ts` calls `assertCompanyAccess`, but this one was missed.

```bash
curl -s http://<target>:3100/api/heartbeat-runs/00000000-0000-0000-0000-000000000001/issues
# -> []  (HTTP 200, not 401 or 403)
```

If an attacker obtains a valid run UUID (from logs, error messages, shared URLs, or by probing), they can read issue data without any credentials.

### 2. Unauthenticated CLI auth challenge creation

`POST /api/cli-auth/challenges` creates a CLI authentication challenge with no actor check at all. The handler at `server/src/routes/access.ts:1638-1659` skips any auth verification.

```bash
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"command":"test"}' \
  http://<target>:3100/api/cli-auth/challenges
# returns challenge ID, token, and a pre-generated board API key
```

The response includes a `boardApiToken` that becomes active once the challenge is approved. Combined with open registration (separate report), this enables persistent API key generation.

### 3. Unauthenticated agent instruction / system prompt leakage

These endpoints in `server/src/routes/access.ts` require no authentication:

```bash
curl -s http://<target>:3100/api/skills/index
# returns all available skill endpoints

curl -s http://<target>:3100/api/skills/paperclip
# returns the FULL agent heartbeat procedure including:
#   - every API endpoint and its parameters
#   - authentication mechanism (env var names, header formats)
#   - the complete agent coordination protocol
#   - the agent creation/hiring workflow

curl -s http://<target>:3100/api/skills/paperclip-create-agent
# returns the full agent creation workflow with adapter configs
```

This hands an attacker a complete map of the internal API without authenticating. It also leaks how agents authenticate, how heartbeats work, and what adapter configurations are available.

### 4. Unauthenticated deployment configuration disclosure

`GET /api/health` returns deployment mode, exposure setting, auth status, bootstrap status, version, and feature flags.

```bash
curl -s http://<target>:3100/api/health
# {
#   "deploymentMode": "authenticated",
#   "deploymentExposure": "public",
#   "authReady": true,
#   "bootstrapStatus": "ready",
#   "version": "2026.403.0",
#   ...
# }
```

Tells an attacker exactly how the instance is configured, whether registration is available, and what version is running.

## Impact

- **Data exposure**: heartbeat run issues accessible without credentials. Agent instructions and full API structure exposed to anyone.
- **Reconnaissance**: an attacker can fingerprint the deployment (mode, version, features) and map the entire internal API before attempting anything else.
- **Auth bypass stepping stone**: unauthenticated CLI challenge creation is a building block for the full RCE chain (reported separately).

## Suggested Fixes

1. **Add authentication to heartbeat run issues** in `server/src/routes/activity.ts`:
   - `GET /api/heartbeat-runs/:runId/issues` -- add `assertCompanyAccess` like every other endpoint in the same file

2. **Add authentication to CLI challenge creation** in `server/src/routes/access.ts`:
   - `POST /api/cli-auth/challenges` -- add `assertBoard` at minimum

3. **Add authentication to skill endpoints** in `server/src/routes/access.ts`:
   - `GET /api/skills/available`
   - `GET /api/skills/index`
   - `GET /api/skills/:skillName`

4. **Reduce health endpoint information** -- consider removing `deploymentMode`, `deploymentExposure`, and `version` from the unauthenticated response, or gating the full response behind `assertBoard`

5. Consider a **global auth rejection middleware** for all `/api/*` routes in `authenticated` mode. Currently unauthenticated requests get `actor: { type: "none" }` and pass through to `next()`, relying on each route handler to check individually. A missing check means an open endpoint. Rejecting `type: "none"` at the middleware level for all routes except an explicit public allowlist (health, sign-in, sign-up, webhooks) would prevent this class of bug entirely.

## Contact

Discord: sagi03581

Happy to help verify fixes or provide additional details.

## Which versions are affected by GHSA-xfqj-r5qw-8g4j?

2 open source packages ship an affected version, including @paperclipai/server.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `@paperclipai/server` | npm | All versions | 2026.416.0 |
| `@paperclipai/server` | npm | All versions | 2026.416.0 |

## How do I fix GHSA-xfqj-r5qw-8g4j?

Upgrade @paperclipai/server to 2026.416.0 or later.

## Is GHSA-xfqj-r5qw-8g4j being exploited?

There is no known exploitation of GHSA-xfqj-r5qw-8g4j in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-xfqj-r5qw-8g4j and fix it if it is affected.

What it is: GHSA-xfqj-r5qw-8g4j is a missing authorization vulnerability in @paperclipai/server, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-xfqj-r5qw-8g4j in the wild and no public exploit code.

Affected packages and fixed versions:
- @paperclipai/server (npm): affected all versions; fixed in 2026.416.0
- @paperclipai/server (npm): affected all versions; fixed in 2026.416.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-xfqj-r5qw-8g4j/ (Markdown: https://insights.sbomify.com/GHSA-xfqj-r5qw-8g4j/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-xfqj-r5qw-8g4j

---
From sbomify Insights: https://insights.sbomify.com/GHSA-xfqj-r5qw-8g4j/
Summaries are generated and may contain mistakes; the official description above is the record.