Authentication Bypass in Obot CLI Login Flow Allows API Key Theft
CVE-2026-114662

8.6HIGH

Key Information:

Vendor

Obot-platform

Status
Obot
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114662?

An authentication bypass vulnerability exists in the CLI login flow of Obot before version 0.26.0. This flaw enables unauthenticated attackers to exploit the system by constructing token requests via the API, allowing them to send login links to authenticated users. Once the link is accessed, attackers can retrieve non-expiring API keys, potentially leading to account takeovers and unauthorized access to sensitive data.

Affected Version(s)

obot 0 < 0.26.0

obot 0.26.0

References

https://github.com/obot-platform/obot/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/obot-before-0.26.0-a...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daniel-mertz
.