CVE-2026-90562CWE-331

CVE-2026-90562

High · published September 13, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00735 · 54.0th percentile
Weakness
CWE-331 · Insufficient Entropy
Published
2026-09-13T15:17Z
References (7)
https://github.com/langbot-app/LangBot · [email protected]https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/api/http/controller/groups/user.py · [email protected]https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/core/stages/genkeys.py · [email protected]https://github.com/langbot-app/LangBot/commit/267232c24f93c515d6fd3f7f81c0676066ab1ab8 · [email protected]https://github.com/langbot-app/LangBot/issues/2392 · [email protected]https://www.vulncheck.com/advisories/langbot-before-4.10.11-authentication-bypass-via-weak-recovery-key · [email protected]https://github.com/langbot-app/LangBot/issues/2392 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 13 SEP 10:45Z
    LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key
    cvelistv5