Key points
- CVE-2026-114662 affects Obot platforms running versions earlier than 0.26.0.
- The flaw allows unauthenticated attackers to steal non-expiring API keys.
- Attackers exploit the CLI login flow by guessing or choosing specific token request IDs.
Obot platforms running versions before 0.26.0 are exposed to a high-severity authentication bypass vulnerability. According to the National Vulnerability Database record for CVE-2026-114662, the flaw resides in the command-line interface login flow. This weakness enables unauthenticated attackers to steal valid API keys without needing prior credentials or access to the system.
The vulnerability carries a CVSS score of 8.6, classified as high severity. It is mapped to CWE-352 in the source records. Attackers can create a token request through the POST /api/token-request endpoint. They then send the associated login link to a user who is already signed in. By fetching the resulting key, the attacker takes over the victim's account.
How the exploit works
The attack relies on the ability to choose or predict token request IDs. An adversary initiates the process by creating a request via the API endpoint. The system generates a link that, when accessed by an authenticated user, produces a new API key. Because the attacker can manipulate the request ID, they can intercept or predict the outcome. This allows them to retrieve the non-expiring key generated for the victim.
Who is affected
Only environments running Obot versions prior to 0.26.0 are affected by this issue. The vulnerability specifically targets the CLI login mechanism within the obot-platform. Any instance using an older version remains vulnerable to this form of account takeover. Organizations should verify their current version numbers immediately to determine exposure.
Next steps
Teams should audit their Obot installations to confirm whether they are running versions before 0.26.0. If an older version is detected, prioritize upgrading to 0.26.0 or later to resolve the authentication bypass. Review existing API keys for signs of unauthorized generation or use. Monitor login logs for anomalous token request patterns that do not match expected user behavior.
Signals worth monitoring
Security teams should watch for unusual spikes in POST requests to the token-request endpoint, especially from new or untrusted IP addresses. Look for login link clicks that are immediately followed by API key fetches from different sessions or locations. Check for token request IDs that appear sequential or predictable, as this may indicate enumeration attempts. Alert on successful key generations that lack corresponding interactive user sessions, and verify that all new keys are issued to authorized administrators.
What to do and how to stay safe: Obot
- Verify your Obot platform version and upgrade to 0.26.0 or later if you are currently running an earlier release.
- Audit recent API key creation logs to identify keys generated via the CLI login flow that you did not authorize.
- Rotate any API keys that were created during the window of exposure to ensure they cannot be compromised.
- Restrict access to the token-request endpoint to trusted networks or internal services if possible.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this Obot vulnerability?
The vulnerability is tracked as CVE-2026-114662.
Which versions of Obot are affected?
Obot versions before 0.26.0 are affected by this authentication bypass.
What is the CVSS score for this flaw?
The CVSS score is 8.6, which is rated as high severity.
