CVE-2026-90562: LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

Q: What does an attacker need to exploit this issue?

An attacker needs the administrator's email address. They can then send concurrent unauthenticated requests to the reset-password endpoint to exhaust the 24-bit recovery-key space.

Q: Which deployments are exposed?

LangBot versions before 4.10.11 are affected. Exposure requires that the unauthenticated password-reset endpoint be reachable by the attacker.

Q: What is the likely impact of successful exploitation?

A successful attacker can reset the administrator password and gain account access. The reported impact includes compromise of confidentiality, integrity, and availability.

Published Sep 13, 2026

Updated

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

Affected Software

1 affected component

LangBot<4.10.11

Event History

Sep 13, 2026

CVE Published

via MITRE·10:45 AM

Data Sourced

via MITRE·10:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs the administrator's email address. They can then send concurrent unauthenticated requests to the reset-password endpoint to exhaust the 24-bit recovery-key space.

Which deployments are exposed?

LangBot versions before 4.10.11 are affected. Exposure requires that the unauthenticated password-reset endpoint be reachable by the attacker.

What is the likely impact of successful exploitation?

A successful attacker can reset the administrator password and gain account access. The reported impact includes compromise of confidentiality, integrity, and availability.

CVE-2026-90562: LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are exposed?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are exposed?

What is the likely impact of successful exploitation?