This vulnerability in waooAI waoowaoo up to version 0.4.1 involves improper authorization due to manipulation of the storageKey argument in the stablePublicIdFromStorageKey function within src/lib/media/hash.ts of the Media Handler component. The flaw allows remote attackers to bypass authorization checks. The attack complexity is high, and no privileges or user interaction are required. Although the exploit has been publicly disclosed, the vendor has not yet responded or provided a fix.

Successful exploitation could allow remote attackers to bypass authorization controls related to media handling, potentially leading to unauthorized access or actions within the affected component. The CVSS score of 6.3 (medium severity) reflects limited impact due to the high attack complexity and lack of privileges required. No evidence of widespread exploitation is reported.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is provided, users should consider restricting access to the affected component or applying compensating controls to limit exposure to untrusted inputs for the storageKey parameter.