Insufficient Entropy and Lack of Rate Limiting in LangBot Password Recovery

LangBot versions prior to 4.10.11 contain a security vulnerability in the password recovery mechanism that allows remote, unauthenticated attackers to hijack administrator accounts. The application generates password reset tokens with only 24 bits of entropy, which results in a significantly small keyspace. Furthermore, the application fails to implement rate limiting on the unauthenticated reset-password endpoint, enabling attackers to systematically brute-force the recovery keys. By targeting a known administrator email address, an attacker can launch concurrent requests to the reset-password endpoint, exhaust the 24-bit keyspace in a short time, and successfully reset the password to gain unauthorized access to the LangBot environment. This vulnerability poses a critical risk to organizations relying on LangBot for sensitive operations, as it bypasses standard authentication controls without requiring prior valid credentials.