Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: langbot-app Clear all filters
TI-2026-76465 CVE-2026-112265 · GHSA-73v9-9646-vcm5

Missing Lark/Feishu webhook authenticity check in LangBot

Priority LOW 35

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00154 Published 2026-10-19 No fix listed CWE-345
TI-2026-61802 CVE-2026-90938 · GHSA-c2c5-ccw6-xvj5

LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket

Priority HIGH 77

LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and i…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00572 Published 2026-09-14 No fix listed CWE-306
TI-2026-61576 CVE-2026-90562 · GHSA-6h2j-ghfm-664v

LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

Priority HIGH 75

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00735 Published 2026-09-13 Fixed in 4.10.11 CWE-331