Authentication Bypass Vulnerability in LettaBot API

A security vulnerability (CVE-2026-18990) has been identified in LettaBot version 0.2.0. The flaw resides within the API Status Route, specifically implemented in the file 'src/api/server.ts'. Due to missing authentication checks, remote attackers can interact with this API endpoint without providing valid credentials. This vulnerability is particularly concerning as a public proof-of-concept exploit exists, and the vendor has remained unresponsive to disclosure attempts. Organizations utilizing this specific version of LettaBot are at risk of unauthorized API interaction, potentially leading to information disclosure or further exploitation depending on the capabilities exposed by the status route.

Attack Chain

1. Attacker performs network reconnaissance to identify internet-facing LettaBot deployments.
2. Attacker probes the API Status Route endpoint (typically associated with src/api/server.ts).
3. Attacker sends a crafted HTTP request to the vulnerable API endpoint.
4. The application fails to validate the requester's identity due to missing authentication logic.
5. The API processes the request and returns status information or executes exposed functions.
6. Attacker leverages the unauthenticated access to exfiltrate system metadata or state information.

Impact

Successful exploitation allows remote attackers to bypass authentication requirements, potentially leading to unauthorized visibility into the operational status of the LettaBot service. While the full scope of exposed status data depends on the specific deployment, the vulnerability grants attackers an entry point into the application's API layer.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

• Audit all internet-facing instances of LettaBot to determine if they are running version 0.2.0.
• Implement access control lists (ACLs) or network-level restrictions (e.g., VPN, firewall) to limit access to the API Status Route to trusted internal IP ranges.
• Deploy web application firewall (WAF) signatures to detect and block abnormal or unauthenticated requests to the API Status Route endpoint.
• Monitor web server logs for high volumes of requests to API endpoints originating from unauthorized sources.