Obot: Authentication bypass in CLI login flow (CVE-2026-114662)

Obot versions before 0.26.0 are affected by an authentication bypass vulnerability within the CLI login flow. An unauthenticated attacker can exploit this by sending a crafted request to the /api/token-request endpoint and tricking a signed-in user into authenticating, which allows the attacker to steal the resulting non-expiring API key. This can lead to full account takeover.

Attack Chain

1. Attacker crafts a token request.
2. Attacker submits the request via a POST /api/token-request call.
3. Attacker lures a signed-in victim to interact with a malicious login link.
4. Victim authenticates through the provided link.
5. Attacker retrieves the non-expiring API key generated by the flow.
6. Attacker uses the stolen API key to gain unauthorized access to the victim account.

Impact

Successful exploitation allows an unauthenticated attacker to steal a user's API key and gain full access to their Obot account.

Recommendation

• Upgrade Obot to version 0.26.0 or later to patch the vulnerable CLI login flow.
• Audit access logs for excessive or anomalous POST requests to the /api/token-request endpoint.