CVE-2026-114662: Obot before 0.26.0 API Key Theft via CLI Login Token Request

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-28
Weakness: CWE-352

Description

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.

Affected products

obot-platform obot: before 0.26.0 — fixed in 0.26.0

How to fix

Upgrade to a fixed version: obot-platform obot 0.26.0. Check the vendor advisory for mitigations.

References

https://github.com/obot-platform/obot/security/advisories/GHSA-2qcm-3gv6-2mfc
https://www.vulncheck.com/advisories/obot-before-0.26.0-api-key-theft-via-cli-login-token-request

Get alerted when CVE-2026-114662 or the next vulnerability affects your stack