CVE-2026-114662GHSA-2qcm-3gv6-2mfc

Obot before 0.26.0 API Key Theft via CLI Login Token Request

obot-platform obot

CVSS

8.6High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in0.26.0Fixed versionCVE List

Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

0.26.0obotCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@stackflag.bsky.social: CVE-2026-114662 - obot Versions of Obot before 0.26.0 let anyone create a special request that, when a logged‑in user clicks a link, returns a permanent API key belonging to that uBluesky: CVE posts, 24 Oct 2026

Description

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.

Text from CVE List

Affected versions 2

obotaffected: all versions before 0.26.0CVE List
obotunaffected: 0.26.0CVE List