Live › vulnerability › CVE-2026-114662
Go to dashboardObot before 0.26.0 lets an unauthenticated attacker create a token request and trick a signed-in user into approving the login link. The attacker then fetches that user's non-expiring API key and takes over the account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Upgrade Obot to 0.26.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.
This page as .md · .json · in your agent: get_signal("CVE-2026-114662")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.