CVE-2026-114662
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that…
- Risk score
- 55/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.26.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
- Remotely exploitable without logging in
References
Original description
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.
Last activity 22 Oct 2026. Patch Forecast updates every hour.