Hardcoded Password in LobsterAI Allows API Key Decryption

Executive Summary

LobsterAI before version 2026.10.16 contains a hardcoded password vulnerability in its Provider API Key Export feature. The software uses a static cryptographic key 'lobsterai-APP' to encrypt exported API keys. Attackers can exploit this by obtaining an exported provider file and deriving the AES-GCM key using PBKDF2 with the embedded salt, allowing decryption of third-party AI provider API keys.

Useful 0 Not Useful 0

Detection Guidance

Check for LobsterAI versions before 2026.10.16 by inspecting installed versions or checking update logs. Look for exported provider files containing API keys encrypted with the hardcoded password 'lobsterai-APP'. Verify if exported files use this default password by attempting decryption with it.

Useful 0 Not Useful 0

Impact Analysis

If you use LobsterAI versions before 2026.10.16, attackers could decrypt your exported provider API keys. This may lead to unauthorized access to third-party AI services, potential API misuse, billing fraud, or exposure of sensitive data processed by those services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for protecting sensitive data and API credentials. Exposure of third-party AI provider API keys could result in unauthorized data processing, breaches of confidentiality, and failure to implement adequate security measures, potentially leading to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade LobsterAI to version 2026.10.16 or later to address the hardcoded password issue. Review and re-encrypt any exported provider files using the new credential requirements. Disable or restrict access to exported provider files until updates are applied.

Useful 0 Not Useful 0