Obot: Authentication bypass in CLI login flow allows API key theft
Summary
Obot before 0.26.0 contains a flaw in the CLI login flow that lets an unauthenticated attacker obtain the API key created for a signed-in user. The attacker creates a token request with a self-chosen ID, sends the login link to the victim, and then fetches the resulting non-expiring API key. A victim who only opens the link can therefore have their account taken over, including admin access if the victim is an administrator.
Affected
- Obot versions before 0.26.0, including v0.25.x up to v0.25.6
- Vendor advisory and OSV list all versions below 0.26.0 as affected
Fixed in
- Upgrade to Obot 0.26.0 or later
Workaround
- Unknown. No vendor-documented workaround is available for versions before 0.26.0.
- Blocking POST /api/token-request at a proxy prevents the attack but also disables CLI login.
Exploitation
- Not marked as known exploited in the sources reviewed (CISA KEV: no).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found; treat as unknown.
Our recommendation
- Upgrade all Obot instances to 0.26.0 or later as a priority, especially if they are reachable from untrusted networks.
- Restrict access to Obot web and API endpoints to trusted networks or VPN until upgraded.
- Review API keys issued through CLI login and revoke any that cannot be attributed to a known user.
- Monitor API logs for unusual token request activity and unexpected logins.
- Remind users not to open unsolicited Obot login links.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2qcm-3gv6-2mfc github.com
- VulnCheck advisory: Obot before 0.26.0 API Key Theft via CLI Login Token Request www.vulncheck.com
- OSV: CVE-2026-114662 osv.dev
- Obot release v0.26.0 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:16.
Original description (NVD)
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.