Unintended Proxy or Intermediary ('Confused Deputy')

Property	Value
Language
Severity
CWE	CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
OWASP	A04:2021 Insecure Design
Confidence Level	High
Impact Level	High
Likelihood Level	High

Description

Marking state-changing HTTP methods (like POST, PUT, PATCH, DELETE) with 'x-openai-isConsequential: false' disables critical user confirmation checks. This means potentially sensitive actions can be executed automatically without requiring explicit user consent.

Impact

If exploited, attackers or automated agents could perform unintended or harmful operations—such as modifying or deleting data—on behalf of users without their awareness or approval. This increases the risk of data loss, unauthorized actions, or abuse of sensitive functionality, potentially leading to serious security breaches.