CVE-2026-114662
Obot before 0.26.0 API Key Theft via CLI Login Token Request
- State
- Published
- Severity
- 8.6 High
- Published
- Oct 22, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 21, 2026
Description
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
obotobot-platform |
|
References
- GitHub Security Advisory (GHSA-2qcm-3gv6-2mfc)vendor-advisory
- VulnCheck Advisory: Obot before 0.26.0 API Key Theft via CLI Login Token Requestthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.