EUVD-2026-45355
GHSA-jgf3-cr8w-g5h9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires low-privilege API access (PR:L) to reach the vulnerable endpoint; identity spoofing yields limited confidentiality, integrity, and availability impact with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the argument Username leads to authentication bypass by spoofing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate other users by manipulating the Username argument in the OpenAPI chat_send endpoint. Affected is the function OpenApiRoute.chat_send in astrbot/dashboard/routes/open_api.py, exposing confidentiality, integrity, and availability at a limited level. A public proof-of-concept exploit exists on GitHub; the vendor did not respond to responsible disclosure, and no patch has been released.
Technical ContextAI
AstrBot (CPE: cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:*) is an open-source AI chatbot framework. The vulnerable component is the OpenAPI route handler in the dashboard (astrbot/dashboard/routes/open_api.py), specifically the chat_send function of OpenApiRoute. CWE-290 (Authentication Bypass by Spoofing) identifies the root cause: the application fails to properly verify the authenticity of the Username parameter, allowing a caller to supply an arbitrary username value and have the server act as though requests originate from that spoofed identity. The CVSS 4.0 vector (PR:L) confirms that some level of existing API access is required, meaning the flaw is not a full unauthenticated bypass but rather a horizontal or vertical privilege escalation via identity spoofing within the API.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure and no fixed version is confirmed. As a compensating control, restrict network-level access to the AstrBot dashboard API endpoint to trusted IP ranges only, preventing untrusted low-privileged users from reaching the chat_send route; note this trade-off reduces API accessibility. Deploying an API gateway or reverse proxy that enforces server-side identity binding (ignoring client-supplied Username values and deriving identity from validated session tokens) can neutralize the spoofing vector, but requires custom middleware development. Monitor for anomalous Username values in API request logs that do not match the authenticated session's identity as a detection measure. Track the AstrBot repository and VulDB entry (https://vuldb.com/vuln/379791) for patch releases, and apply any fix immediately upon availability.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today