CVE-2025-59835

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.

LangBot's plugin runtime (pip package langbot_plugin) through version 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 with authentication based on a key that defaults to an empty string and is never set. A remote attacker can register an arbitrary 'debug plugin' without credentials, receive full context of IM messages, inject forged replies, send messages as bots, read knowledge bases, and register malicious tools.

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

LangBot version 4.10.7 and earlier has a vulnerability that allows any authenticated user to add or change an STDIO MCP server configuration without an adequate authorization boundary. An attacker can configure commands and arguments that are executed as a subprocess on the LangBot server, enabling arbitrary command execution with LangBot service privileges.