CVE-2026-114662

Obot versions before 0.26.0 are vulnerable to an authentication bypass in the CLI login flow. Unauthenticated attackers can steal non-expiring API keys by creating a token request via POST /api/token-request and sending the login link to a signed-in user. By choosing specific token request IDs, t...

EUVD-2026-107904

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the...