CVE-2026-114662 in Obot
Summary
by MITRE • 10/23/2026
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Obot versions prior to 0.26.0 represents a critical authentication bypass flaw within its command-line interface login mechanism. This security defect stems from an improper validation of token request identifiers during the session establishment process. Specifically, the application fails to adequately verify that the user initiating the final API key retrieval is the same entity that originally requested the token generation. This logical error allows an attacker who has initiated a legitimate-looking authentication flow to manipulate the subsequent steps by specifying arbitrary or pre-determined token request IDs rather than waiting for the system to generate and assign them dynamically in a secure manner.
The operational impact of this vulnerability is severe, as it facilitates account takeover through social engineering combined with technical exploitation. An attacker begins by creating a token request via the POST /api/token-request endpoint, which generates a unique identifier associated with that specific authentication session. The system then sends a login link to an authenticated user, presumably under the guise of a legitimate administrative action or routine verification. However, because the validation logic is flawed, the attacker can intercept this process and use their own controlled token request ID when attempting to complete the authentication sequence. By doing so, they trick the server into associating the new session with the victim's existing credentials rather than generating a fresh one for the attacker.
Once the attack chain is completed, the result is the issuance of a non-expiring API key that belongs to the victim but is held by the attacker. Since these keys do not expire, they provide persistent access to the compromised account without requiring further interaction from the user or detection through standard session timeout mechanisms. This effectively grants the adversary full control over the victim's identity within the Obot platform, potentially leading to unauthorized data access, modification of critical configurations, and lateral movement into connected systems that trust these API keys for authentication.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, specifically relating to the failure to properly verify user identity during login processes. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as it involves the misuse of legitimate credentials and authentication tokens by an unauthorized party. The specific mechanism of manipulating token identifiers places it within the realm of logic flaws where business rules regarding session management are not strictly enforced at the code level.
Mitigation for this issue requires immediate patching to version 0.26.0 or later, which addresses the underlying validation logic in the CLI login flow. In addition to upgrading, organizations should implement strict input validation on all token request identifiers to ensure they match expected formats and are tied directly to the initiating user's session context without allowing external manipulation. Implementing short-lived tokens with mandatory re-authentication for sensitive operations can also reduce the window of opportunity for such attacks. Furthermore, monitoring API logs for unusual patterns in token request IDs or rapid succession of login attempts from different IP addresses may help detect exploitation attempts before full account compromise occurs.