@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot Summary @eeacms/volto-chatbot exposes an Express middleware route /v1da/ that accepts unauthenticated HTTP requests from any network client and proxies them to the configured upstream Danswer API, automatically attaching t...