CVE-2021-41191

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add `@require_apikey` in `BOT/lib/cogs/website.py` under the route for `/v1/products`.

• CWE-116

• https://github.com/Redon-Tech/Roblox-Purchasing-Hub/commit/58a22260eca40b1a0377daf61ccd8c4dc1440e03Patch, Third Party Advisory
• https://github.com/Redon-Tech/Roblox-Purchasing-Hub/releases/tag/V1.0.2Release Notes, Third Party Advisory
• https://github.com/Redon-Tech/Roblox-Purchasing-Hub/security/advisories/GHSA-76mx-6584-4v8qThird Party Advisory
• https://github.com/Redon-Tech/Roblox-Purchasing-Hub/commit/58a22260eca40b1a0377daf61ccd8c4dc1440e03Patch, Third Party Advisory
• https://github.com/Redon-Tech/Roblox-Purchasing-Hub/releases/tag/V1.0.2Release Notes, Third Party Advisory
• https://github.com/Redon-Tech/Roblox-Purchasing-Hub/security/advisories/GHSA-76mx-6584-4v8qThird Party Advisory

Published

Oct 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41186Fluentd collects events from various data sources and writes…7.5
• CVE-2021-41187DHIS 2 is an information system for data capture, management…8.8
• CVE-2021-41188Shopware is open source e-commerce software. Versions prior …5.4
• CVE-2021-41189DSpace is an open source turnkey repository application. In …7.2
• CVE-2021-4119bookstack is vulnerable to Improper Access Control9.8
• CVE-2021-41190The OCI Distribution Spec project defines an API protocol to…5
• CVE-2021-41192Redash is a package for data visualization and sharing. If a…6.5
• CVE-2021-41193wire-avs is the audio visual signaling (AVS) component of Wi…9.8
• CVE-2021-41194FirstUseAuthenticator is a JupyterHub authenticator that hel…9.8
• CVE-2021-41195TensorFlow is an open source platform for machine learning. …5.5
• CVE-2021-41196TensorFlow is an open source platform for machine learning. …5.5
• CVE-2021-41197TensorFlow is an open source platform for machine learning. …5.5