Read the docs

langbot-app

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

langbot-app records in CISA KEV

No langbot-app vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2026-61802 CVE-2026-90938 · GHSA-c2c5-ccw6-xvj5

LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket

Priority HIGH 77

LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and i…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00572 Published 2026-09-14 No fix listed CWE-306
TI-2026-61576 CVE-2026-90562 · GHSA-6h2j-ghfm-664v

LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

Priority HIGH 75

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00735 Published 2026-09-13 Fixed in 4.10.11 CWE-331
TI-2026-76465 CVE-2026-112265 · GHSA-73v9-9646-vcm5

Missing Lark/Feishu webhook authenticity check in LangBot

Priority LOW 35

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00154 Published 2026-10-19 No fix listed CWE-345
Open these records in search →