EUVD-2026-76987
GHSA-6h2j-ghfm-664v
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint (AV:N/PR:N) but exploitation needs known admin email plus concurrent keyspace exhaustion (AC:H); success grants full admin control (C/I/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.
AnalysisAI
Administrator account takeover in LangBot before 4.10.11 stems from password-recovery keys generated with only 24 bits of entropy (secrets.token_hex(3)) combined with a total absence of rate limiting on the unauthenticated reset-password endpoint. A remote attacker who knows the administrator's email address can fire concurrent requests to exhaust the ~16.7M-value keyspace and reset the admin password, seizing full control of the instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) network reachability of the unauthenticated reset-password HTTP endpoint (AV:N/PR:N - no login needed); (2) knowledge of the administrator's registered email address, used to target the reset; and (3) the ability to send many concurrent requests to brute-force the 24-bit recovery key, since the endpoint applied no rate limiting (AT:P/AC:H reflect this attack requirement and effort). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 9.2 reflects unauthenticated network reachability (AV:N/PR:N) with full compromise of the admin account (VC:H/VI:H/VA:H), tempered by AC:H and AT:P - the attack requires knowing the admin email and mounting a concurrent keyspace-exhaustion campaign rather than a single trivial request. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to LangBot 4.10.11 or later, which contains the fix (Vendor-released patch: 4.10.11; commit https://github.com/langbot-app/LangBot/commit/267232c24f93c515d6fd3f7f81c0676066ab1ab8). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct an urgent inventory of all LangBot deployments and identify any running versions prior to 4.10.11; simultaneously audit administrator account activity logs for unauthorized password resets, session creation, or system configuration changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-331 – Insufficient Entropy
View allShare
External POC / Exploit Code
Leaving vuln.today