Jan versions <=0.8.4 contain a Cross-Origin Resource Sharing (CORS) misconfiguration in the local API server. The server replaces user-configured trusted hosts with a wildcard that reflects arbitrary origins and includes credentials, effectively bypassing trusted host restrictions. This allows attackers on the local network or via DNS rebinding to access the unauthenticated OpenAI-compatible API endpoints. Exploitation can lead to unauthorized inference requests, model enumeration, invocation of MCP tools, and reading of cross-origin responses. The vulnerability is addressed in a commit identified as 3e1c1e7, which is after version 0.8.4. No vendor advisory or patch link is currently available to confirm remediation status.

An attacker on the local network or using DNS rebinding can bypass trusted host restrictions and access the unauthenticated API. This can lead to unauthorized use of inference capabilities, enumeration of available models, invocation of management/control tools (MCP tools), and unauthorized reading of cross-origin responses. The vulnerability exposes sensitive API functionality without authentication, increasing the risk of information disclosure and unauthorized operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is fixed in a commit after version 0.8.4, upgrading to a version including that fix is recommended once available. Until then, restrict network access to the local API server to trusted hosts only and consider network-level controls to prevent DNS rebinding attacks.