{"schema":"threatline.record/2","record":{"id":"GHSA-2qcm-3gv6-2mfc","aliases":["GHSA-2qcm-3gv6-2mfc"],"summary":"CLI login flow could be used to steal another user's API key","details":"## Summary\n\nIn affected versions, an unauthenticated attacker could start a CLI login, send the login link to a signed-in Obot user, and collect the API key that was created when that user opened the link. The attacker could then act as that user through the Obot API, the LLM gateway, and MCP servers.\n\n## Am I affected?\n\nYou are affected if you run any Obot version before `v0.26.0`. That includes the `v0.25.x` patch releases, through `v0.25.6`, which were not patched. The attack only works if a user who is signed in to Obot, or can sign in through your identity provider, opens a link the attacker sends them.\n\n## Details\n\nThe `obot` CLI signs in through a token request: the client creates a request, the user signs in through the browser, and the client then fetches the resulting API key. The client chose the request's ID, and neither creating the request nor fetching the key required authentication or was tied to the browser that signed in. An attacker could create a request with an ID they knew, get a user to open the sign-in link for it, and then fetch the API key Obot created for that user. The attacker also chose the key's scopes and could make it never expire.\n\n## Impact\n\nThe worst case is takeover of the victim's Obot account through a long-lived API key that carries the victim's permissions, including API, LLM gateway, and MCP server access. If the victim is an admin, the attacker gets admin access. The victim only has to open one link. The attacker does not learn the victim's identity provider credentials.\n\n## Mitigation\n\nUpgrade to **v0.26.0** or later. The CLI now uses a device-code flow: Obot generates the request ID, and the signed-in user must enter the code shown by the CLI before a key is issued. After upgrading, review your users' API keys and delete any that were not created on purpose. If you cannot upgrade, blocking `POST /api/token-request` at your proxy prevents the attack, but it also disables CLI login.\n\n## Severity\n\nCVSS v3.1 Score: **8.1/10 (High)** — `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N`\n\n## Credits\n\nThe Obot team would like to thank [@daniel-mertz](https://github.com/daniel-mertz) for responsibly disclosing this issue in accordance with our [security policy](https://github.com/obot-platform/obot/?tab=security-ov-file).","categories":["Unclassified"],"product":"github.com/obot-platform/obot","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/obot-platform/obot/security/advisories/GHSA-2qcm-3gv6-2mfc","source_modified_at":"2026-10-06T23:53:52Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/obot-platform/obot"},"range":"< 0.26.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/obot-platform/obot/security/advisories/GHSA-2qcm-3gv6-2mfc","source_modified_at":"2026-10-06T23:53:52Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/obot-platform/obot"},"version":"0.26.0"}],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-06T23:53:52Z","modified_at":"2026-10-06T23:53:52Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/obot-platform/obot/security/advisories/GHSA-2qcm-3gv6-2mfc","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T23:53:52Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-06T23:53:52Z","content_hash":"f4d3e8c35919c5e0493a0659e57618c32a43e2684138f443d9a5edbde49367e8"}}