{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/obot--0.26.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:obot:obot:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-114662"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Obot (\u003c 0.26.0)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","api-security","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Obot"],"content_html":"\u003cp\u003eObot versions before 0.26.0 are affected by an authentication bypass vulnerability within the CLI login flow. An unauthenticated attacker can exploit this by sending a crafted request to the /api/token-request endpoint and tricking a signed-in user into authenticating, which allows the attacker to steal the resulting non-expiring API key. This can lead to full account takeover.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a token request.\u003c/li\u003e\n\u003cli\u003eAttacker submits the request via a POST /api/token-request call.\u003c/li\u003e\n\u003cli\u003eAttacker lures a signed-in victim to interact with a malicious login link.\u003c/li\u003e\n\u003cli\u003eVictim authenticates through the provided link.\u003c/li\u003e\n\u003cli\u003eAttacker retrieves the non-expiring API key generated by the flow.\u003c/li\u003e\n\u003cli\u003eAttacker uses the stolen API key to gain unauthorized access to the victim account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to steal a user's API key and gain full access to their Obot account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Obot to version 0.26.0 or later to patch the vulnerable CLI login flow.\u003c/li\u003e\n\u003cli\u003eAudit access logs for excessive or anomalous POST requests to the /api/token-request endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T09:54:16Z","date_published":"2026-10-22T09:54:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-obot-auth-bypass/","summary":"Obot versions prior to 0.26.0 contain an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to harvest API keys by manipulating token requests.","title":"Obot: Authentication bypass in CLI login flow (CVE-2026-114662)","url":"https://feed.craftedsignal.io/briefs/2026-10-obot-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Obot (\u003c 0.26.0)","version":"https://jsonfeed.org/version/1.1"}