Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning
Priority MEDIUM 64CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims' Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim's Khoj search index. This attack requires knowing the user's UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00414 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed khoj (khoj-ai): 2.0.0-beta.23
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| khoj-ai | khoj | before 2.0.0-beta.23 | 2.0.0-beta.23 | Patch available | CNA |
| — | khoj (PyPI) | up to 2.0.0b25.dev3 | — | No fix listed | GHSA-6whj-7qmg-86qj |
- khoj Vendorkhoj-ai Affected before 2.0.0-beta.23 Fixed in 2.0.0-beta.23 Patch available CNA
- khoj (PyPI) Vendor— Affected up to 2.0.0b25.dev3 Fixed in — No fix listed GHSA-6whj-7qmg-86qj
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:khoj:khoj:*:*:*:*:*:*:*:* | before 2.0.0 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta1:*:*:*:*:*:* | 2.0.0 beta1 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta10:*:*:*:*:*:* | 2.0.0 beta10 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta11:*:*:*:*:*:* | 2.0.0 beta11 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta12:*:*:*:*:*:* | 2.0.0 beta12 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta13:*:*:*:*:*:* | 2.0.0 beta13 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta14:*:*:*:*:*:* | 2.0.0 beta14 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta15:*:*:*:*:*:* | 2.0.0 beta15 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta16:*:*:*:*:*:* | 2.0.0 beta16 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta17:*:*:*:*:*:* | 2.0.0 beta17 | Vulnerable | khoj-ai |
- cpe:2.3:a:khoj:khoj:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta10:*:*:*:*:*:* Versions 2.0.0 beta10 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta11:*:*:*:*:*:* Versions 2.0.0 beta11 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta12:*:*:*:*:*:* Versions 2.0.0 beta12 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta13:*:*:*:*:*:* Versions 2.0.0 beta13 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta14:*:*:*:*:*:* Versions 2.0.0 beta14 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta15:*:*:*:*:*:* Versions 2.0.0 beta15 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta16:*:*:*:*:*:* Versions 2.0.0 beta16 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta17:*:*:*:*:*:* Versions 2.0.0 beta17 Vulnerable ·khoj-ai
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:khoj:khoj:2.0.0:beta18:*:*:*:*:*:* | 2.0.0 beta18 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta19:*:*:*:*:*:* | 2.0.0 beta19 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta2:*:*:*:*:*:* | 2.0.0 beta2 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta20:*:*:*:*:*:* | 2.0.0 beta20 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta21:*:*:*:*:*:* | 2.0.0 beta21 | Vulnerable | khoj-ai |
| cpe:2.3:a:khoj:khoj:2.0.0:beta22:*:*:*:*:*:* | 2.0.0 beta22 | Vulnerable | khoj-ai |
- cpe:2.3:a:khoj:khoj:2.0.0:beta18:*:*:*:*:*:* Versions 2.0.0 beta18 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta19:*:*:*:*:*:* Versions 2.0.0 beta19 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta20:*:*:*:*:*:* Versions 2.0.0 beta20 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta21:*:*:*:*:*:* Versions 2.0.0 beta21 Vulnerable ·khoj-ai
- cpe:2.3:a:khoj:khoj:2.0.0:beta22:*:*:*:*:*:* Versions 2.0.0 beta22 Vulnerable ·khoj-ai
Remediation
- Fix · CNA khoj (khoj-ai) Fixed in 2.0.0-beta.23
Timeline
- 2026-10-02 Threatist record created from CVE-2025-69207
- 2026-10-03 Alias added: GHSA-6whj-7qmg-86qj
References
More khoj-ai Khoj vulnerabilities
- TI-2024-16867 Prompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clients CVSS 3.1HIGH 7.5
- TI-2024-29045 Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature) CVSS 3.1MEDIUM 5.4
Sources
- CVE-2025-69207 · CVE Program
- CVE-2025-69207 · NVD
- FIRST EPSS
- GHSA-6whj-7qmg-86qj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences