ZCode Open Source Release Followed by Security Concerns: Default Encryption Key Can Be Derived from Username and Path

Beating AI News Flash: After ZCode was open-sourced, developers discovered a security issue in the code. ZCode encrypts and stores user login credentials locally, but by default, the decryption key can be directly derived from the operating system, username, and user directory.

This information is usually not difficult to obtain. Once an attacker gets hold of the file where ZCode stores credentials, they can regenerate the key based on the public source code without needing to crack the encryption algorithm.

ZCode's official documentation claims these login credentials are "encrypted per device and cannot be decrypted after switching devices." However, the default scheme in the public source code does not use device IDs or hardware information. The official statement does not match the open-source code.

However, this is not a vulnerability that allows credentials to be stolen remotely out of thin air. An attacker still needs to first obtain the local credential file; if users set ZCODE_CREDENTIAL_SECRET themselves, the above default key will not be used.

Once the file is leaked, login sessions for ZCode, Z.ai, or BigModel may be restored, leading to account impersonation or consumption of Coding Plan quotas, but it will not result in the computer being hacked.