OpenCode Studio versions before 2.4.4 contain a missing authentication vulnerability affecting multiple API endpoints. Unauthenticated remote attackers can read arbitrary files from the temp and static/music directories via GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can access intermediate audio, video artifacts, and subtitles belonging to other users. Additionally, the unauthenticated DELETE /api/short-video/:videoId endpoint allows any attacker to delete videos by ID. The vulnerability exposes sensitive user job artifacts and enables destructive actions without any credentials. A fix was released in version 2.4.4, with the patch available via a GitHub commit. The issue was tracked and resolved through GitHub issues and pull requests.