CVE-2026-90562criticalCWE-331

CVE-2026-90562: falha crítica em langbot-app LangBot

LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar LangBot

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.7%
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
langbot-app · LangBot
CVEs relacionadas — langbot-app LangBot

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54449HIGHLangBot: Authenticated RCE Via MCP ConfigurationEPSS 0.7%CVE-2026-90938HIGHLangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocketEPSS 0.6%CVE-2025-59835HIGHLangBot has a cross-directory file upload vulnerability, which could lead to system takeoverEPSS 0.4%CVE-2026-28509MEDIUMLangBot has a Cross Site Scripting(XSS) VulnerabilityEPSS 0.2%CVE-2026-112265HIGHLangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity VerificationEPSS 0.2%