LangBot EUVD-2026-76987

Exploitation requires: (1) network reachability of the unauthenticated reset-password HTTP endpoint (AV:N/PR:N - no login needed); (2) knowledge of the administrator's registered email address, used to target the reset; and (3) the ability to send many concurrent requests to brute-force the 24-bit recovery key, since the endpoint applied no rate limiting (AT:P/AC:H reflect this attack requirement and effort). Limiting factors: the target must be running LangBot before 4.10.11 with the reset endpoint exposed, and the attacker must already know or guess the exact admin email; instances not reachable from the attacker's network, or fronted by a rate-limiting/authenticating proxy, are substantially harder to exploit.

The CVSS 4.0 base score of 9.2 reflects unauthenticated network reachability (AV:N/PR:N) with full compromise of the admin account (VC:H/VI:H/VA:H), tempered by AC:H and AT:P - the attack requires knowing the admin email and mounting a concurrent keyspace-exhaustion campaign rather than a single trivial request. This is a genuine account-takeover primitive, not a high-score-but-low-impact issue: 24 bits is exhaustible in practice, and the absence of rate limiting removes the usual brute-force barrier, so even a mid-sized municipal IT team should treat an exposed LangBot admin panel as urgent. Counterbalancing signals are that there is no CISA KEV listing and no public exploit identified, and exploitation still hinges on network exposure of the reset endpoint plus knowledge of the admin email, so realistic risk is highest for internet-facing deployments and lower for internal-only instances. EPSS was not provided in the input and cannot be cited.

An attacker who knows the LangBot administrator's email address sends a flood of concurrent POST requests to the unauthenticated reset-password endpoint, each guessing a recovery key across the 24-bit space. With no rate limiting, the keyspace is exhausted, a guess matches, and the attacker resets the admin password and logs in with full control of the bot platform. No public exploit is identified at time of analysis, but the technique is straightforward to script.