Seventeen Vulnerabilities in Omi, Fourteen Days of Silence Author: Ahmet Kazankaya ( @kasparovabi on GitHub) Date published: April 29, 2026 (Day 14) GHSA: GHSA-4j2c-fmg6-8h42 (filed April 15, 2026) CVSS: 10.0 (Critical) TL;DR On April 15, 2026, I privately reported 14 security vulnerabilities in the BasedHardware/omi backend through GitHub’s coordinated disclosure process. The advisory covers remote code execution, authentication bypass, a hardcoded production encryption key in the public repository, server-side request forgery, path traversal, OAuth CSRF, and unauthenticated access to users’ personal conversation data. GitHub rated the aggregate severity as CVSS 10.0 (Critical). Fourteen days later, the state of that advisory is: triage (no maintainer ever moved it past the initial state) Zero comments from the maintainer team on the advisory itself No CVE assigned None of the 14 findings patched All of the ready-to-merge patches in my private fork untouched During the same fourteen days, the repository received more than 300 commits on unrelated work, the founder publicly acknowledged the advisory on Twitter and then let it slide, and two external contributors opened public pull requests that referenced the same vulnerabilities by the exact file paths I had reported privately. On April 27 (Day 12) the maintainer beastoin closed the larger of those PRs ( #6813 , titled “Security hardening: RCE, SSRF, IDOR, auth backdoor, firmware keys, replay, XSS, DoS”) without merging and without explanation, leaving the underlying vulnerabilities intact. The smaller PR ( #6804 , path traversal only) is still open and slowly under review. While the original 14 findings sat in triage , three new vulnerabilities were introduced by feature commits during the same window. Two of them (BYOK fingerprint hashing, BYOK WebSocket validation gap) live in the new “Bring Your Own Keys” feature. The third, OMI-15 , is a hardcoded admin bypass token committed to a brand-new admin panel module: web/admin/lib/dev-auth.ts exports DEV_BYPASS_TOKEN = "dev-bypass-token" and web/admin/lib/auth.ts accepts that exact string as a valid admin credential whenever a non-production environment variable is set. The exact anti-pattern that the original advisory flagged in the Python backend (OMI-02 / OMI-04) was therefore replicated in the TypeScript admin panel during the disclosure window. The product collects audio recordings of private conversations, targets healthcare and sales professionals, markets itself as “SOC 2 + HIPAA compliant” with the tagline “Open source. Own your data. Runs on your device.” Every clause of that tagline is contradicted by the code. This writeup documents what is broken, what the vendor has said (and not said), and why the coordinated disclosure window has effectively ended. What Omi Is Omi is a wearable AI device priced at $179 that records conversations around the user continuously. It pairs with a mobile app on iPhone and Android, a desktop app on macOS, and a web app. It transcribes speech in real time, generates summaries and action items, maintains a searchable memory of every conversation the user has had, and exposes an “App Store” of third-party integrations that can read and write to the user’s memory graph. The company markets the product for three primary personas: Sales professionals who want call summaries and CRM sync Healthcare workers who want hands-free note taking during patient interactions Technicians who want field-service documentation The vendor claims 300,000 professional users. The backend is open-source Python / FastAPI, deployed on Google Cloud Run at api.omi.me . The codebase is BasedHardware/omi . What I Found On April 15, 2026, I conducted a static security audit of the backend directory. I reported 14 findings across four severity bands. The full technical detail is in the GHSA and in the MITRE CVE request I filed on Day 5. Summary below. Every file path and line number in the original 14 was verified again on Day 14 against main branch; all are still present. In addition, I scanned the 300+ commits added during the disclosure window and identified three new findings in code that did not exist on Day 0 (OMI-15, OMI-16, OMI-17 below). Total now stands at 17. Critical (4) ID Finding File Evidence OMI-01 Remote code execution via eval() on values read from Redis backend/database/redis_db.py Seven eval() calls at lines 117, 128, 164, 173, 224, 235, 287 on data written back as str(...) OMI-02 Authentication bypass via ADMIN_KEY prefix match backend/utils/other/endpoints.py lines 29-31 if admin_key and token.startswith(admin_key): return token[len(admin_key):] OMI-03 Production-grade ENCRYPTION_SECRET committed to the public repository backend/.env.template (line 47 at filing, line 50 at publication, the same value the entire window) ENCRYPTION_SECRET='omi_ZwB2ZNqB2HHpMK6wStk7sTpavJiPTFg7gXUHnc4tFABPU6pZ2c2DKgehtfgi4RZv' OMI-04 Authentication bypass via LOCAL_DEVELOPMENT flag returning hardcod...