CVE-2026-90562 — LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attacker…
Published: 2026-09-13 · CVSS: 9.2 · CVSS 4.0
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7