AI-written code merged the entire PATCH request body into settings without a whitelist, letting authenticated users disable authentication and expose protected routes.

  /**  * Get provider credentials from localDb- * Filters out unavailable accounts and returns the highest priority available account+ * Filters out unavailable accounts and returns the selected account based on strategy  * @param {string} provider - Provider name  * @param {string|null} excludeConnectionId - Connection ID to exclude (for retry with next account)  */ export async function getProviderCredentials(provider, excludeConnectionId = null) {   const connections = await getProviderConnections({ provider, isActive: true });-  +   if (connections.length === 0) {     log.warn("AUTH", `No credentials for ${provider}`);     return null;@@ -28,7 +28,26 @@ export async function getProviderCredentials(provider, excludeConnectionId = nul     return null;   } -  const connection = availableConnections[0];+  const settings = await getSettings();+  const strategy = settings.fallbackStrategy || "fill-first";++  let connection;+  if (strategy === "round-robin") {+    // Sort by lastUsed (nulls first) to pick the least recently used+    const sorted = [...availableConnections].sort((a, b) => {+      if (!a.lastUsedAt && !b.lastUsedAt) return (a.priority || 999) - (b.priority || 999);+      if (!a.lastUsedAt) return -1;+      if (!b.lastUsedAt) return 1;+      return new Date(a.lastUsedAt) - new Date(b.lastUsedAt);+    });+    connection = sorted[0];++    // Update lastUsedAt asynchronously+    updateProviderConnection(connection.id, { lastUsedAt: new Date().toISOString() }).catch(() => {});+  } else {+    // Default: fill-first (already sorted by priority in getProviderConnections)+    connection = availableConnections[0];+  }    return {     apiKey: connection.apiKey,

 import { Card, Button, Badge, Toggle } from "@/shared/components"; import { useTheme } from "@/shared/hooks/useTheme"; import { APP_CONFIG } from "@/shared/constants/config";  export default function ProfilePage() {   const { theme, setTheme, isDark } = useTheme();+  const [settings, setSettings] = useState({ fallbackStrategy: "fill-first" });+  const [loading, setLoading] = useState(true);++  useEffect(() => {+    fetch("/api/settings")+      .then((res) => res.json())+      .then((data) => {+        setSettings(data);+        setLoading(false);+      })+      .catch((err) => {+        console.error("Failed to fetch settings:", err);+        setLoading(false);+      });+  }, []);+

+      if (res.ok) {+        setSettings(prev => ({ ...prev, fallbackStrategy: strategy }));+      }+    } catch (err) {+      console.error("Failed to update settings:", err);+    }+  };    return (     <div className="max-w-2xl mx-auto">@@ -28,6 +59,31 @@ export default function ProfilePage() {

+            <div className="flex items-center justify-between">+              <div>+                <p className="font-medium">Round Robin</p>+                <p className="text-sm text-text-muted">+                  Cycle through accounts to distribute load+                </p>+              </div>+              <Toggle+                checked={settings.fallbackStrategy === "round-robin"}+                onChange={() => updateFallbackStrategy(settings.fallbackStrategy === "round-robin" ? "fill-first" : "round-robin")}+                disabled={loading}+              />+            </div>+            <p className="text-xs text-text-muted italic pt-2 border-t border-border/50">+              {settings.fallbackStrategy === "round-robin"+                ? "Currently distributing requests across all available accounts."+                : "Currently using accounts in priority order (Fill First)."}+            </p>

-    "/api/settings/:path*",-    "/api/keys",-    "/api/keys/:path*",-    "/api/providers/client",-    "/api/provider-nodes/validate",-    "/api/cli-tools/:path*",-    "/api/mcp/:path*",-    "/api/translator/:path*",-    "/api/tunnel/:path*",-  ],+  matcher: ["/((?!_next/static|_next/image|favicon\\.ico).*)"], };

+  "/api/auth/login",+  "/api/auth/logout",+  "/api/auth/status",+  "/api/auth/oidc",+  "/api/version",+  "/api/settings/require-login",

   "/api/shutdown",   "/api/settings/database",+  "/api/version/shutdown",+  "/api/version/update",+  "/api/oauth/cursor/auto-import",+  "/api/oauth/kiro/auto-import", ];  // Require auth, but allow through if requireLogin is disabled const PROTECTED_API_PATHS = [   "/api/settings",   "/api/keys",-  "/api/providers/client",-  "/api/provider-nodes/validate",+  "/api/providers",+  "/api/provider-nodes",+  "/api/proxy-pools",+  "/api/combos",+  "/api/models",+  "/api/usage",+  "/api/oauth",+  "/api/cloud",+  "/api/media-providers",+  "/api/pricing",+  "/api/tags",   "/api/cli-tools",   "/api/mcp",   "/api/translator",   "/api/tunnel", ]; -// Routes that spawn child processes — restrict to localhost regardless of auth.+// Routes that spawn child processes or read host secrets — restrict to localhost. const LOCAL_ONLY_PATHS = [   "/api/cli-tools/cowork-settings",   "/api/mcp/",   "/api/tunnel/tailscale-install",+  "/api/oauth/cursor/auto-import",+  "/api/oauth/kiro/auto-import", ];  const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);@@ -85,13 +116,18 @@ async function isAuthenticated(request) {   return false;

   const { pathname } = request.nextUrl; -  // Local-only gate for spawn-capable routes (CVE GHSA-fhh6-4qxv-rpqj).

+        try {+          controller.enqueue(encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`));+        } catch {+          closed = true;+        }       };        try {@@ -52,7 +58,7 @@ export async function POST(request) {           : error.message;         send("error", { error: msg });       } finally {-        controller.close();+        if (!closed) { try { controller.close(); } catch {} }       }     },   });