CVE-2026-5557CWE-287CWE-288

badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass

Medium · published April 5, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00506 · 42.3th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-04-05T09:45Z
EPSS history
Timeline
  • 05 APR 09:45Z
    badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass
    cvelistv5