github.com/obot-platform/obot: CLI login flow could be used to steal another user's API key

Summary

In affected versions, an unauthenticated attacker could start a CLI login, send the login link to a signed-in Obot user, and collect the API key that was created when that user opened the link. The attacker could then act as that user through the Obot API, the LLM gateway, and MCP servers.

Am I affected?

You are affected if you run any Obot version before v0.26.0. That includes the v0.25.x patch releases, through v0.25.6, which were not patched. The attack only works if a user who is signed in to Obot, or can sign in through your identity provider, opens a link the attacker sends them.

Details

The obot CLI signs in through a token request: the client creates a request, the user signs in through the browser, and the client then fetches the resulting API key. The client chose the request's ID, and neither creating the request nor fetching the key required authentication or was tied to the browser that signed in. An attacker could create a request with an ID they knew, get a user to open the sign-in link for it, and then fetch the API key Obot created for that user. The attacker also chose the key's scopes and could make it never expire.

Impact

The worst case is takeover of the victim's Obot account through a long-lived API key that carries the victim's permissions, including API, LLM gateway, and MCP server access. If the victim is an admin, the attacker gets admin access. The victim only has to open one link. The attacker does not learn the victim's identity provider credentials.

Mitigation

Upgrade to v0.26.0 or later. The CLI now uses a device-code flow: Obot generates the request ID, and the signed-in user must enter the code shown by the CLI before a key is issued. After upgrading, review your users' API keys and delete any that were not created on purpose. If you cannot upgrade, blocking POST /api/token-request at your proxy prevents the attack, but it also disables CLI login.

Severity

CVSS v3.1 Score: 8.1/10 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Credits

The Obot team would like to thank @daniel-mertz for responsibly disclosing this issue in accordance with our security policy.