AutoGPT Platform Chat Session IDOR / Session Hijack — CVE-2026-30950

Metadata

Affected Target

Summary

The AutoGPT Platform’s chat-session API exposes a PATCH /sessions/{session_id}/assign-user route that lets an authenticated user attach their own account to a chat session record, but the route performs no check that the caller currently owns the session being modified. The underlying service function calls assign_user_to_session with user_id=None, which causes the data-access layer’s ownership-mismatch check to short-circuit and skip entirely, returning the session unconditionally. As a result, any authenticated user who knows or guesses another user’s session_id (which appears in URLs, logs, referer headers, or support tickets) can reassign that session to themselves, hijacking the victim’s in-progress chat session.

Vulnerability Details

Root Cause

session_assign_user (routes.py) is gated only by generic authentication (Security(auth.requires_user)) and forwards the request to assign_user_to_session(session_id, user_id), which itself calls get_chat_session(session_id, None) — passing user_id=None instead of the caller’s ID. The data accessor’s mismatch check if user_id is not None and session.user_id != user_id short-circuits to False when user_id is None, so ownership is never verified before the session is handed over and re-cached under the new owner.

Attack Vector

1. Attacker holds any valid authenticated Supabase JWT for the AutoGPT Platform (a normal signed-up account is sufficient).
2. Attacker obtains a target session_id (UUID) via a leaked referer header, shared link, screen share, server log, or support ticket.
3. Attacker sends PATCH /sessions/{session_id}/assign-user with their own JWT.
4. The backend reassigns the session’s user_id to the attacker and caches the change in Redis; subsequent requests by the original owner are rejected by the same (now attacker-favoring) ownership check.

Impact

Any authenticated user can hijack any other user’s chat session, gaining access to the victim’s conversation state/history and continuity of their session — a session-level account takeover requiring only authentication, not authorization.

Environment / Lab Setup

Target:   AutoGPT Platform backend >= 0.6.36, < 0.6.51 with the chat (copilot) feature enabled
Attacker: Python 3, Docker/docker-compose (setup/ scripts to stand up a local instance)

Proof of Concept

PoC Script

See pocs/session_hijack.py and setup/setup.sh / setup/teardown.sh / setup/docker-compose.override.yml in this folder.

1
2
3

setup/setup.sh
python3 pocs/session_hijack.py
setup/teardown.sh

setup/setup.sh stands up a local AutoGPT Platform instance for testing; session_hijack.py authenticates as a low-privileged attacker account and issues the PATCH /sessions/{session_id}/assign-user request against a victim’s session ID to demonstrate the takeover.

Detection & Indicators of Compromise

Signs of compromise:

• Chat sessions abruptly reassigned to a different user_id with no corresponding user action
• Repeated assign-user calls from a single account against many distinct session IDs (enumeration)
• Victim reports of losing access to an in-progress chat session unexpectedly

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/ZeroPathAI/autogpt-CVE-2026-30950-poc on 2026-07-05.