Zeptoclaw
CVE-2026-32231
HIGH
GHSA-46q5-g3j9-wx5c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6.
AnalysisAI
High severity vulnerability in ZeptoClaw. # The generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | ZeptoClaw webhook authentication disabled (auth_token: None, the default configuration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Severity: High (8.2/10.0) No EPSS data available yet HIGH RISK: Remotely exploitable without authentication — internet-facing instances are directly vulnerable Patch is available — prioritize updating to the fixed version Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | This vulnerability can be exploited remotely without authentication or user interaction, making it suitable for automated scanning and mass exploitation. |
| Remediation | Patches available: - https://github.com/qhkm/zeptoclaw/pull/324 - https://github.com/qhkm/zeptoclaw/commit/bf004a20d3687a0c1a9e052ec79536e30d6de134 Security advisories: - https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-46q5-g3j9-wx5c Update to the latest patched version as soon as possible. Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable the ZeptoClaw webhook endpoint or require authentication via firewall/WAF rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today