CVE-2026-90562 Details
Description
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.
A vulnerability in LangBot versions 4.0.8.1 prior to 4.10.11 allows for unauthenticated password recovery key exploitation, leading to admin account takeover. The recovery keys are generated with only 24 bits of entropy, equivalent to 16,777,216 possible values. The `POST /api/v1/user/reset-password` endpoint, which resets the admin password, lacks rate limiting and other protections against automated attacks. As a result, an attacker who knows the admin's email can brute-force the recovery key and gain access to the account.
Users can update to LangBot version 4.10.11 or later, where this vulnerability has been fixed. The update includes a regeneration of the recovery key with higher entropy and the introduction of a concurrency-safe throttle on the reset-password endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 13, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/langbot-app/LangBot/issues/2392 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/langbot-app/LangBot | [email protected] | ProductVendor |
| https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/api/http/controller/groups/user.py | [email protected] | Source CodeVendor |
| https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/core/stages/genkeys.py | [email protected] | Source CodeVendor |
| https://github.com/langbot-app/LangBot/commit/267232c24f93c515d6fd3f7f81c0676066ab1ab8 | [email protected] | Source CodeVendor |
| https://github.com/langbot-app/LangBot/issues/2392 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/langbot-before-4.10.11-authentication-bypass-via-weak-recovery-key | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LangBot | >= 4.0.8.1, < 4.10.11 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 13, 2026 | New CVE Received | [email protected] |