CVE-2026-114662 Obot before 0.26.0 API Key Theft via CLI Login Token Request
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114662?
CVE-2026-114662 is a high-severity vulnerability in obot-platform obot, published on 22 Oct 2026.
Official description
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.
Weakness: CWE-352
Which versions are affected by CVE-2026-114662?
How do I fix CVE-2026-114662?
No fix has been published for CVE-2026-114662 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114662 being exploited?
There is no known exploitation of CVE-2026-114662 in the wild and no public exploit code.
Sources
Also known as GHSA-2qcm-3gv6-2mfc, GHSA-p9v9-jrq9-jpjv.