CVE-2026-114662: Obot before 0.26.0 API Key Theft via CLI Login Token Request

Q: What does an attacker need to exploit this issue?

The attacker does not need to authenticate. They must create a token request through POST /api/token-request, choose the token request ID, and persuade a signed-in user to use the associated login link.

Q: What is the impact if exploitation succeeds?

The attacker can retrieve the API key produced by the victim's login flow. Because the key is non-expiring, the attacker can use it to take over the victim's account.

Q: Which deployments are affected?

Obot versions before 0.26.0 are affected. The issue is in the CLI login flow and its token-request API endpoint.

Published Oct 22, 2026

Updated

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.

Affected Software

1 affected component

Obot Obot<0.26.0

Event History

Oct 22, 2026

CVE Published

via MITRE·01:43 AM

Data Sourced

via MITRE·01:43 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker does not need to authenticate. They must create a token request through POST /api/token-request, choose the token request ID, and persuade a signed-in user to use the associated login link.

What is the impact if exploitation succeeds?

The attacker can retrieve the API key produced by the victim's login flow. Because the key is non-expiring, the attacker can use it to take over the victim's account.

Which deployments are affected?