CVE-2026-34999CWE-306

OpenViking 0.2.5 < 0.2.14 Bot Proxy Endpoints Allow Unauthenticated Access

Medium · published April 1, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
55.6
In the wild
Unconfirmed
What it is

OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access protected bot proxy functionality by sending requests to the POST /bot/v1/chat and POST /bot/v1/chat/stream endpoints. Attackers can bypass authentication checks and interact directly with the upstream bot backend through the OpenViking proxy without providing valid credentials.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00782 · 55.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-04-01T13:30Z
EPSS history
Timeline
  • 01 APR 13:30Z
    OpenViking 0.2.5 < 0.2.14 Bot Proxy Endpoints Allow Unauthenticated Access
    cvelistv5