CVE-2026-114662CWE-352csrf

CVE-2026-114662

High · published October 22, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00172 · 6.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-10-22T06:16Z
References (2)
https://github.com/obot-platform/obot/security/advisories/GHSA-2qcm-3gv6-2mfc · [email protected]https://www.vulncheck.com/advisories/obot-before-0.26.0-api-key-theft-via-cli-login-token-request · [email protected]
EPSS history
Timeline
  • 23 OCT 03:55Z
    EPSS moved — → 0%
    epss
  • 22 OCT 01:43Z
    Obot before 0.26.0 API Key Theft via CLI Login Token Request
    cvelistv5
  • 22 OCT 01:43Z
    Obot before 0.26.0 API Key Theft via CLI Login Token Request
    cvelistv5