EUVD-2026-33533
GHSA-r6vm-4xwg-w69h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_agent.py. Such manipulation of the argument session_id leads to authorization bypass. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate the session_id argument within the astr_main_agent function to access or control sessions belonging to other users. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the server fails to verify that the requesting user owns the supplied session_id. A publicly available exploit exists via GitHub gist, no vendor patch has been released, and the vendor did not respond to disclosure - elevating practical risk above what the CVSS 6.3 Medium score alone implies.
Technical ContextAI
AstrBot is an open-source AI agent and chatbot orchestration framework developed by AstrBotDevs. The vulnerable code resides in astrbot/core/astr_main_agent.py within the astr_main_agent function, which processes agent session routing. The flaw maps to CWE-639 (Authorization Bypass Through User-Controlled Key): the application accepts a client-supplied session_id as an authorization key without performing server-side ownership validation to confirm the requesting user is entitled to operate on that session. This is a classic Insecure Direct Object Reference (IDOR) variant at the session layer. The CPE cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not scoped the affected range to a precise version boundary - only 4.24.2 is explicitly named in the CVE description.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure and no patched release version is available. As an immediate compensating control, administrators should restrict AstrBot access to the smallest possible set of trusted, individually authenticated users, removing shared or low-trust accounts that could serve as an attacker foothold. Deploying a network-level control such as a VPN gateway, reverse proxy with strong authentication, or firewall rules limiting inbound access to the AstrBot API port will reduce exposure to network-adjacent attackers. Security teams with access to the source code should audit astrbot/core/astr_main_agent.py to add server-side ownership validation - confirming that the authenticated user's identity matches the owner of the supplied session_id before processing the request. Monitor the AstrBotDevs GitHub repository and VulDB entry https://vuldb.com/vuln/367491 for patch availability. The public exploit at https://gist.github.com/YLChen-007/91a7f955143099e1747424707dfad0f9 can assist defenders in writing detection signatures for request anomaly monitoring.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today