CVE-2025-48491

Published May 30, 2025 Modified Apr 15, 2026 CWE-798

Description

Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been patched in the pre-beta version.

Is your site exposed to CVE-2025-48491?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-798 CWE-798

References

Other References

https://github.com/aryan6673/project-ai/commit/142252c43f1dacb3fed99e3336f5cd863b028bc2 https://github.com/aryan6673/project-ai/commit/1de910f353eb2a68c980149b906e7495459296ad https://github.com/aryan6673/project-ai/commit/54a69c3ccd301d35f3d54f4844d9910e609beb73 https://github.com/aryan6673/project-ai/commit/7f3b93f9aa9085d5413b4019172b0e56676346d7 https://github.com/aryan6673/project-ai/commit/8db90e3d9777850741804533ebde5824b4a5795c https://github.com/aryan6673/project-ai/commit/99e0e0718edb0e59c5d3c5a69903b87c69fcfe7a https://github.com/aryan6673/project-ai/commit/ab67979a46b0e343dc20a95a2b65d3c4994c31e7 https://github.com/aryan6673/project-ai/commit/c1fb156418d98a1e6c60bb680db57e9558785093 https://github.com/aryan6673/project-ai/security/advisories/GHSA-8486-vrcp-69rv

Frequently Asked Questions

What is CVE-2025-48491? +
Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been patched in the pre-beta version.
How do I check if I'm vulnerable to CVE-2025-48491? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-42251

Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. …
CVE-2026-61740

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, …
CVE-2025-3426

We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is …
CVE-2025-4049

Use of hard-coded, the same among all vulnerable installations SQLite credentials vulnerability in SIGNUM-NET FARA allows to read and manipulate …
CVE-2025-4569

An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could …
CVE-2025-4570

An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2025-48491 — free, no signup required.