High severity · published Sep 13, 2026
CVE-2026-90562
LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key
8.1
CVSS
0.7%
EPSS
No
On KEV
Description
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
LangBot · langbot-app
4.0.8.1 before 4.10.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90562
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90562
github.com
https://github.com/langbot-app/LangBot
github.com
https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/api/http/controller/groups/user.py
github.com
https://github.com/langbot-app/LangBot/blob/v4.10.2/src/langbot/pkg/core/stages/genkeys.py
github.com
https://github.com/langbot-app/LangBot/commit/267232c24f93c515d6fd3f7f81c0676066ab1ab8
github.com
https://github.com/langbot-app/LangBot/issues/2392
www.vulncheck.com
https://www.vulncheck.com/advisories/langbot-before-4.10.11-authentication-bypass-via-weak-recovery-key
More from LangBot
8.8
CVE-2026-54449
LangBot: Authenticated RCE Via MCP Configuration
8.6
CVE-2026-90938
LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket
8.6
CVE-2025-59835
LangBot has a cross-directory file upload vulnerability, which could lead to system takeover
6.5
CVE-2026-112265
LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification
5.4
CVE-2026-28509
LangBot has a Cross Site Scripting(XSS) Vulnerability