Api — CraftedSignal Threat Feed

OpenViking Authentication Bypass Vulnerability (CVE-2026-40525)

hello@craftedsignal.io — Fri, 17 Apr 2026 19:16:39 +0000

OpenViking, a bot management framework, contains a critical authentication bypass vulnerability (CVE-2026-40525) affecting versions prior to commit c7bb167. Specifically, the VikingBot OpenAPI HTTP route surface fails to enforce authentication when the api_key configuration value is either unset or configured as an empty string. This vulnerability enables remote attackers with network access to the exposed OpenViking service to bypass authentication controls and execute privileged bot-control functionalities. This includes submitting attacker-controlled prompts, creating or manipulating bot sessions, and gaining unauthorized access to downstream tools, integrations, secrets, and sensitive data that the bot has access to. Given the potential for broad impact and ease of exploitation, this vulnerability poses a significant risk to organizations using vulnerable versions of OpenViking.

Attack Chain

Attacker identifies a vulnerable OpenViking instance with an exposed VikingBot OpenAPI endpoint.
Attacker checks the api_key configuration on the target, either through misconfiguration or default settings, it’s found to be unset or empty.
Attacker crafts a malicious HTTP request to the VikingBot OpenAPI endpoint, omitting the required X-API-Key header.
Due to the authentication bypass, the vulnerable OpenViking instance processes the attacker’s request without proper authentication.
Attacker utilizes the exposed bot-control functionalities to submit malicious prompts.
Attacker creates or hijacks bot sessions, leveraging the compromised session to access downstream systems.
Attacker leverages the bot’s permissions to access internal tools, integrations, and secrets, potentially escalating privileges.
Attacker exfiltrates sensitive data or compromises downstream systems accessible to the bot.

Impact

Successful exploitation of CVE-2026-40525 allows attackers to completely bypass authentication controls and gain full access to bot control functionalities within the OpenViking framework. This could lead to unauthorized access to sensitive data, compromise of downstream systems and integrations, and potential financial loss. The CVSS v3.1 base score for this vulnerability is 9.1, highlighting its critical severity and the potential for widespread damage.

Recommendation

Immediately upgrade OpenViking to a version containing commit c7bb167 or later to patch CVE-2026-40525.
If upgrading is not immediately possible, configure a strong, unique api_key value within the OpenViking configuration to mitigate the authentication bypass.
Deploy the Sigma rule “OpenViking Authentication Bypass Attempt” to detect unauthorized requests to the VikingBot API endpoint lacking the X-API-Key header.
Monitor web server logs for HTTP requests to the VikingBot OpenAPI endpoint without the X-API-Key header to identify potential exploitation attempts using the “OpenViking API requests without API Key” Sigma rule.
Review access logs for downstream systems connected to OpenViking for any unauthorized activity originating from the OpenViking server following potential exploitation.

Paperclip Cross-Tenant Agent API Key IDOR Vulnerability

hello@craftedsignal.io — Thu, 16 Apr 2026 22:49:46 +0000

A critical vulnerability exists in the Paperclip control-plane API, specifically in versions prior to 2026.416.0. The vulnerability allows a board user with membership in one company (e.g., Company A) to manipulate agent API keys for agents belonging to a different company (e.g., Company B). This is due to an Insecure Direct Object Reference (IDOR) in the /agents/:id/keys routes (GET, POST, DELETE) where the API only validates the user’s board-type session but fails to verify access to the company owning the target agent. By exploiting this flaw, an attacker can mint a new agent API key for an agent in the victim tenant, granting them full agent-level access within that tenant. This cross-tenant compromise allows the attacker to execute workflows, read data, and call any endpoint authorized for agents in the victim tenant, effectively breaching tenant isolation. The vulnerability was introduced due to missing company access checks in the key-management routes.

Attack Chain

The attacker authenticates as a board user within Company A.
The attacker discovers or obtains the UUID of an agent belonging to Company B.
The attacker sends a POST request to /agents//keys with a name to create a new API key.
The server, lacking proper authorization checks, creates a new API key associated with the victim agent’s companyId and returns the cleartext token.
The attacker uses the newly minted agent token in the Authorization header to authenticate subsequent requests.
The server’s authentication middleware incorrectly sets the req.actor to an agent type associated with the victim’s company.
The attacker successfully accesses resources and executes actions within Company B’s tenant, bypassing company access checks.
The attacker can enumerate and revoke existing keys using the /agents/:id/keys and /agents/:id/keys/:keyId endpoints, causing denial of service to legitimate users.

Impact

This vulnerability leads to a full cross-tenant compromise. An attacker can gain unauthorized access to any tenant within the Paperclip instance, provided they have a minimal valid account (board user in any company) and a victim agent UUID. This allows the attacker to execute workflows, read sensitive data, and call any authorized endpoint within the victim tenant, leading to complete confidentiality, integrity, and availability loss. Furthermore, the attacker can revoke legitimate agent keys, resulting in a denial of service. This represents a scope change, where a vulnerability in Company A’s scoping checks results in catastrophic impact within Company B’s tenant.

Recommendation

Implement explicit company-access checks on the /agents/:id/keys (GET, POST) and /agents/:id/keys/:keyId (DELETE) routes before interacting with the service layer. This directly addresses the core issue as described in the advisory’s “Recommended Fix” section.
Deploy the Sigma rule Detect Paperclip Cross-Tenant API Key Creation to identify unauthorized API key creation attempts.
Deploy the Sigma rule Detect Paperclip Cross-Tenant API Access to detect unauthorized access using stolen agent tokens.
Upgrade to npm/@paperclipai/server version 2026.416.0 or later to patch the vulnerability as mentioned in the advisory’s “Affected Packages” section.

Kimsuky Malware Using Dropbox API for Command and Control

hello@craftedsignal.io — Thu, 19 Mar 2026 12:00:00 +0000

Kimsuky, a North Korean APT group, has been observed utilizing malware that leverages the Dropbox API for command and control (C2). This allows the malware to blend in with legitimate network traffic, making detection more challenging. The malware uses the Dropbox API to upload stolen data and download commands from the attackers. This method provides a covert channel for exfiltration and control, bypassing traditional network-based security measures. The group has been known to target South Korean entities, but the scope of targeting may extend beyond this region. This technique has been observed starting in early 2026.

Attack Chain

Initial access is gained through an unconfirmed vector, such as spear phishing or watering hole attacks, delivering an initial downloader.
The downloader executes and establishes persistence, potentially by creating scheduled tasks or modifying registry keys.
The malware initializes the Dropbox API, authenticating with stolen or embedded API keys.
The malware enumerates files on the compromised system, targeting documents, credentials, and other sensitive data.
Stolen data is compressed and encrypted before being uploaded to a designated Dropbox folder controlled by the attacker, using the Dropbox API.
The malware periodically checks the attacker’s Dropbox folder for new commands, also using the Dropbox API.
Downloaded commands are decrypted and executed on the compromised system, enabling actions such as remote code execution or further data exfiltration.
The cycle of data exfiltration and command execution continues, allowing the attacker to maintain persistent access and control over the compromised system.

Impact

Successful attacks can lead to significant data breaches, intellectual property theft, and espionage. Kimsuky’s targeting of South Korean entities suggests a focus on political and strategic intelligence gathering. The use of Dropbox as a C2 channel allows the attackers to remain undetected for extended periods, maximizing the impact of the compromise. The number of victims is currently unknown, but the potential for widespread compromise is high.

Recommendation

Monitor network traffic for unusual API calls to Dropbox, especially from unknown or suspicious processes (see: “Detect Suspicious Dropbox API Usage” Sigma rule).
Implement strict access controls and monitoring for Dropbox API usage within the organization.
Investigate and block any suspicious processes attempting to access Dropbox API endpoints.
Deploy the Sigma rules in this brief to your SIEM and tune for your environment.

Okta API Token Revoked

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This alert focuses on detecting the revocation of Okta API tokens. Okta API tokens are used to authenticate and authorize applications to access Okta’s APIs. When a token is revoked, it means that the token is no longer valid and can no longer be used to access Okta’s APIs. This can happen for a number of reasons, including: a user manually revoking the token, an administrator revoking the token, or Okta automatically revoking the token due to inactivity or security concerns. Detecting API token revocations is crucial because it can indicate that a token has been compromised and is being used by an attacker. A revoked token could be a sign of successful lateral movement or data exfiltration attempts within the Okta environment.

Attack Chain

Initial Access: An attacker gains unauthorized access to an Okta API token through methods like phishing, credential stuffing, or malware.
API Usage: The attacker uses the stolen API token to access Okta’s APIs, potentially gathering sensitive information or modifying user accounts.
Anomaly Detection: Okta’s security mechanisms or custom alerts identify unusual activity associated with the API token, such as access from unfamiliar locations or excessive API calls.
Investigation Triggered: Security personnel initiate an investigation based on the flagged anomalous activity.
Token Revocation: As part of the incident response process, the compromised API token is manually or automatically revoked to prevent further unauthorized access. This action generates a “system.api_token.revoke” event in the Okta system log.
Post-Revocation Analysis: Security teams analyze the events leading up to the token revocation to identify the root cause of the compromise and assess the scope of the attacker’s activities.

Impact

Successful compromise of an Okta API token can lead to significant damage, including unauthorized access to sensitive user data, modification of user accounts and permissions, and disruption of critical business operations. If not detected promptly, attackers can leverage compromised tokens to escalate privileges, move laterally within the Okta environment, and potentially gain access to other connected systems. A single compromised API token could affect hundreds or thousands of users, depending on the scope of access granted to the token.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect system.api_token.revoke events in Okta logs.
Investigate any detected system.api_token.revoke events to determine the cause of the revocation and assess the potential impact.
Review Okta system logs for anomalous activity prior to the token revocation to identify the source of the compromise.
Implement multi-factor authentication (MFA) for all Okta users to reduce the risk of credential compromise.
Regularly audit and review Okta API tokens to identify and revoke unused or overly permissive tokens.