IDOR Vulnerability in Khoj AI Application Affects User Integrations
CVE-2025-69207

5.4MEDIUM

Key Information:

Vendor: Khoj-ai
Status: Khoj
Vendor: CVE Published:; 2 February 2026

What is CVE-2025-69207?

The Khoj AI application is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability in its Notion OAuth callback mechanism. This issue arises in versions before 2.0.0-beta.23, allowing an attacker to exploit the state parameter and gain unauthorized access. By manipulating this parameter, attackers can hijack a victim's Notion integration, effectively replacing their configurations with malicious ones. Such exploitation can lead to data poisoning and a breach of sensitive information contained within the victim's search index. The vulnerability can be particularly dangerous as it may expose user UUIDs through shared AI-generated content, broadening the attack surface. The flaw has been addressed in the latest release.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch