Langbot
Monthly
Administrator account takeover in LangBot before 4.10.11 stems from password-recovery keys generated with only 24 bits of entropy (secrets.token_hex(3)) combined with a total absence of rate limiting on the unauthenticated reset-password endpoint. A remote attacker who knows the administrator's email address can fire concurrent requests to exhaust the ~16.7M-value keyspace and reset the admin password, seizing full control of the instance. VulnCheck reported the issue and a vendor patch exists (4.10.11); no public exploit is identified at time of analysis, and the flaw is not in CISA KEV.
LangBot is a global IM bot platform designed for LLMs. versions up to 4.8.7 is affected by cross-site scripting (xss) (CVSS 6.3).
Administrator account takeover in LangBot before 4.10.11 stems from password-recovery keys generated with only 24 bits of entropy (secrets.token_hex(3)) combined with a total absence of rate limiting on the unauthenticated reset-password endpoint. A remote attacker who knows the administrator's email address can fire concurrent requests to exhaust the ~16.7M-value keyspace and reset the admin password, seizing full control of the instance. VulnCheck reported the issue and a vendor patch exists (4.10.11); no public exploit is identified at time of analysis, and the flaw is not in CISA KEV.
LangBot is a global IM bot platform designed for LLMs. versions up to 4.8.7 is affected by cross-site scripting (xss) (CVSS 6.3).