An authorization vulnerability in onyx-dot-app Onyx versions prior to 3.1.10, 3.2.14, and 4.0.0 allows authenticated users to access the sensitive OAuth credentials of other users.

The vulnerability stems from the improper handling of per-user tokens, which are copied into shared administrative database records. As a result, any user with basic access can retrieve these tokens via specific API endpoints, leading to an incorrect authorization outcome.

Successful exploitation allows an authenticated attacker to steal OAuth Authorization headers belonging to other users, including potentially administrative accounts. This leads to unauthorized account access and potential data compromise across the platform. With a CVSS score of 9.6, the risk of privilege escalation and lateral movement is extreme.

Immediate Action: Update the Onyx platform to version 3.1.10, 3.2.14, or 4.0.0 to remediate the token storage and exposure flaw.

Proactive Monitoring: Review application logs for unusual API activity targeting the /api/mcp/servers endpoints and investigate any unauthorized attempts to access or use OAuth tokens.

Compensating Controls: Implement strict access control lists at the network or application level to restrict API access until the patch is applied.

Public Exploit Available: exploit_available (unknown)

The vulnerability presents a significant risk to user identity and platform integrity. Organizations using the Onyx AI platform should apply the provided security updates immediately to prevent the unauthorized exposure and potential misuse of sensitive user credentials.