Allstar Reviewbot CVE-2025-61926

Exploitation requires that the operator has enabled and exposed the Allstar Reviewbot component's webhook endpoint so it is network-reachable; in that state the endpoint is vulnerable by default because it validates inbound webhooks against the hard-coded secret 'FooBar' compiled into the binary, which cannot be changed at runtime (only by editing source and rebuilding - an undocumented, easily missed step). No authentication is needed (CVSS PR:N) and the known secret removes any signature barrier. The key limiting factors are: Reviewbot is not enabled in standard Allstar setups (rare, non-default deployment), the endpoint must be externally reachable, and impact is confined to repository-workflow integrity (triggering reviews/comments/checks) with no confidentiality or availability impact; deployments on v4.5+ or without Reviewbot exposed are not affected.

This is a genuine but low-to-moderate priority issue whose real-world risk is heavily gated by deployment conditions. The vendor CVSS 4.0 base score is 4.6 (medium), driven by AV:N/AC:L/PR:N/UI:N (network-reachable, trivially exploitable, unauthenticated) but tempered by AT:P (an attack requirement - the Reviewbot endpoint must actually be deployed and exposed) and an impact profile of VI:H with VC:N/VA:N (integrity-only, no confidentiality or availability loss). EPSS is low at 0.40% (32nd percentile), there is no CISA KEV listing, and no public exploit (POC) was identified - all signals point away from widespread active exploitation. However, these signals are consistent rather than conflicting: the secret value ('FooBar') is visible in the open-source repository, so while no packaged exploit exists, the exploitation material is effectively public, which the low EPSS does not fully capture. The limiting factor dominates the assessment: the advisory states Reviewbot 'is not commonly enabled in standard Allstar setups,' so the population of exploitable deployments is small. Net: a real authentication-bypass flaw that is trivial to exploit where present, but a low aggregate priority because the affected component is rarely deployed and impact is confined to repository-workflow integrity. One data discrepancy to note: the input tag 'Information Disclosure' contradicts the CVSS vector (VC:N) and the vendor advisory, which explicitly scope the impact to integrity, not confidentiality.

An attacker locates an internet-reachable Allstar Reviewbot webhook endpoint and crafts webhook requests signed with the hard-coded shared secret compiled into the binary (visible in the open-source repo as 'FooBar'). Because signature verification succeeds, Reviewbot accepts the forged requests as authentic and triggers review automations - posting comments or reviews, influencing required checks, or otherwise manipulating repository signals. No public exploit was identified at time of analysis, but the secret's presence in source code makes exploitation straightforward and requires no authentication.