CVE-2026-90562
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.
Risk Assessment
Weak key entropy and lack of rate limiting enable admin account takeover, leading to full application compromise. The risk is critical because the attack requires no authentication.
Recommendation
Upgrade LangBot to version 4.10.11 or later. In the meantime, implement rate limiting on the password reset endpoint and consider temporarily disabling the password recovery feature.
Other vulnerabilities in LangBot
See all- CVE-2026-90938High
LangBot's plugin runtime (pip package langbot_plugin) through version 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 with authentication based on a key that defaults to an empty string and is never set. A remote attacker can register an arbitrary 'debug plugin' without credentials, receive full context of IM messages, inject forged replies, send messages as bots, read knowledge bases, and register malicious tools.
- CVE-2026-54449High
LangBot version 4.10.7 and earlier has a vulnerability that allows any authenticated user to add or change an STDIO MCP server configuration without an adequate authorization boundary. An attacker can configure commands and arguments that are executed as a subprocess on the LangBot server, enabling arbitrary command execution with LangBot service privileges.
Original NVD description (English source)
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.