---
id: "CVE-2026-114662"
kind: "vulnerability"
aliases: ["CVE-2026-114662"]
title: "Obot: CLI login flaw lets attackers steal non-expiring API keys"
severity: "high"
cvss: 8.6
epss: 0.00172
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["api-keys", "obot", "runtime", "self-hosted"]
not_affected_if: ["version-0.26.0-or-later"]
published_at: "2026-10-22T02:16:58+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114662", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114662", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Obot: CLI login flaw lets attackers steal non-expiring API keys

Obot before 0.26.0 lets an unauthenticated attacker create a token request and trick a signed-in user into approving the login link. The attacker then fetches that user's non-expiring API key and takes over the account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

Upgrade Obot to 0.26.0 or later.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114662
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114662

## From the sources

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_