CVE-2025-69207 Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning
Attackers can hijack Notion integrations and poison search indexes by exploiting an IDOR in the OAuth callback, requiring user UUID knowledge.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-69207?
CVE-2025-69207 is a medium-severity authentication bypass vulnerability in khoj-ai khoj, published on 2 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims' Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim's Khoj search index. This attack requires knowing the user's UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23.
Weakness: CWE-639
Which versions are affected by CVE-2025-69207?
3 open source packages ship an affected version, including khoj. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
khoj PyPI | All versions to 2.0.0b25.dev3 | None |
khoj PyPI | All versions to 2.0.0b25.dev3 | None |
khoj PyPI | All versions to 2.0.0b25.dev3 | None |
Products include Khoj Khoj.
How do I fix CVE-2025-69207?
No fix has been published for CVE-2025-69207 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-69207 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69207 exists.
Other vulnerabilities in khoj-ai khoj
Sources
Also known as GHSA-6whj-7qmg-86qj, PYSEC-2026-1491.