This vulnerability affects the Forget-C Jellyfish AI Short Drama Studio software in versions 0.1.0-alpha, 0.2.0, 0.3.0, 0.3.1, and 0.3.2. It arises from missing authentication in an unspecified function within the FastAPI component located in backend/app/dependencies.py. The flaw allows remote attackers to initiate actions without authentication, potentially leading to unauthorized access or operations. The CVSS 4.0 base score is 6.9 (medium severity), with attack vector network, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. The issue was reported but the GitHub issue was closed due to inactivity, and no official patch or fix has been documented.

The vulnerability allows remote attackers to bypass authentication controls in the affected versions of Jellyfish AI Short Drama Studio, potentially enabling unauthorized access or actions. The impact on confidentiality, integrity, and availability is rated as low, indicating limited but non-negligible potential harm. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix has been documented and the GitHub issue was closed due to inactivity, users should monitor vendor communications for updates. Until a fix is available, consider restricting network access to the affected service to trusted users only.