CVE-2026-90562criticalCWE-331

CVE-2026-90562: fallo crítico en langbot-app LangBot

LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear LangBot

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.2epss 0.7%
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
langbot-app · LangBot
CVEs relacionadas — langbot-app LangBot

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-54449HIGHLangBot: Authenticated RCE Via MCP ConfigurationEPSS 0.7%CVE-2026-90938HIGHLangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocketEPSS 0.6%CVE-2025-59835HIGHLangBot has a cross-directory file upload vulnerability, which could lead to system takeoverEPSS 0.4%CVE-2026-28509MEDIUMLangBot has a Cross Site Scripting(XSS) VulnerabilityEPSS 0.2%CVE-2026-112265HIGHLangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity VerificationEPSS 0.2%