Changing one letter bypassed an admin API in HuggingFace

A flaw in Hugging Face Chat’s request handling reportedly exposed administrative endpoints without authentication. The security check looked for paths beginning with “/admin/” before the framework decoded URL-encoded characters. An attacker could therefore send a request to “/%61dmin/export”: the check saw a different string and skipped the admin-secret requirement, while SvelteKit later decoded “%61” to “a” and routed the request to the protected admin handler. The mismatch let a single encoded character bypass the access control.

The export endpoint could aggregate conversations across sessions for a selected model, including users’ prompts and replies, save the results in a temporary directory, and upload them to a dataset destination configured for the host. The attacker could trigger this bulk export without logging in, although the account describing the issue says the requester would not directly receive the exported data. The central risk was thus unauthorized access to a powerful internal operation that could collect private chat records, rather than a direct download by the attacker. The vulnerability was reportedly identified by researcher RenwaX23 using V12, an autonomous security tool.