CVE-2026-90562: LangBot Authentication Bypass Vulnerability

CVE-2026-90562 Overview

LangBot versions prior to 4.10.11 contain an authentication bypass vulnerability in the password recovery workflow. The application generates password reset keys with only 24 bits of entropy and enforces no rate limiting on the unauthenticated reset-password endpoint. Remote attackers who know the administrator email address can brute force the keyspace through concurrent HTTP requests. Successful exploitation resets the administrator password and grants full account access. The weakness is categorized as insufficient entropy [CWE-331].

Critical Impact

Unauthenticated remote attackers can take over LangBot administrator accounts by exhausting a 24-bit recovery key space, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

• LangBot versions prior to 4.10.11
• LangBot v4.10.2 (referenced in source analysis)
• LangBot deployments exposing the password recovery endpoint to untrusted networks

Discovery Timeline

• 2026-09-13 - CVE-2026-90562 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90562

Vulnerability Analysis

The vulnerability resides in the LangBot password recovery mechanism implemented in src/langbot/pkg/core/stages/genkeys.py and the reset endpoint in src/langbot/pkg/api/http/controller/groups/user.py. The recovery key generation stage produces a token with only 24 bits of entropy, yielding roughly 16.7 million possible values. That search space is trivially exhaustible by an automated client issuing concurrent HTTP requests.

The reset-password endpoint accepts these keys without authentication and without any rate limiting, lockout, or per-account throttling. Attackers with knowledge of the administrator email can iterate candidate keys in parallel until one matches. A successful match allows the attacker to set a new administrator password and take over the account.

Because LangBot commonly serves as an orchestration layer for LLM-driven chat automations, administrator compromise exposes bot configurations, connected credentials, and downstream integrations.

Root Cause

Two defects combine to produce the vulnerability. First, the recovery key generator uses an insufficient random output length, producing 24 bits of entropy where modern practice requires at least 128 bits for security-sensitive tokens. Second, the reset endpoint lacks anti-automation controls such as rate limiting, request throttling, CAPTCHA, or account lockout after repeated failures. The classification maps to [CWE-331: Insufficient Entropy].

Attack Vector

Exploitation requires network access to the LangBot HTTP interface and knowledge of the administrator email address. The attacker submits many concurrent password reset attempts, each containing a candidate recovery key, until the server accepts one. Once accepted, the attacker submits a new password and authenticates as administrator.

# Patch excerpt: src/langbot/pkg/core/stages/genkeys.py
# Source: https://github.com/langbot-app/LangBot/commit/267232c24f93c515d6fd3f7f81c0676066ab1ab8
from __future__ import annotations

import logging
import secrets

from .. import stage, app

# This stage runs before SetupLoggerStage, so ap.logger is still None here;
# the module logger falls back to the stderr lastResort handler.
_logger = logging.getLogger(__name__)

# 32 symbols without 0/O or 1/I; eight independent draws provide 40 random bits.
_RECOVERY_KEY_ALPHABET = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ'
_RECOVERY_KEY_LENGTH = 8


@stage.stage_class('GenKeysStage')
class GenKeysStage(stage.BootingStage):

The patched controller in src/langbot/pkg/api/http/controller/groups/user.py additionally imports hmac for constant-time comparison and time for throttling logic. See the LangBot commit 267232c for the complete fix.

Detection Methods for CVE-2026-90562

Indicators of Compromise

• High volumes of HTTP requests to the LangBot password reset endpoint originating from single or distributed source IPs within short time windows
• Successful administrator authentication events immediately following bursts of reset attempts
• Unexpected changes to administrator password hashes, session tokens, or bot configuration state
• Outbound connections from LangBot to unfamiliar destinations after administrator activity

Detection Strategies

• Baseline normal request rates to the LangBot reset endpoint and alert on statistical outliers
• Correlate failed reset attempts with subsequent successful password changes for the same account
• Deploy web application firewall rules that count requests per source IP against the recovery URL path
• Review LangBot application logs for repeated reset-password invocations targeting the administrator email

Monitoring Recommendations

• Forward LangBot HTTP access logs to a centralized logging platform for retention and search
• Enable alerting on administrator account modifications and session creations from new IP addresses
• Monitor egress traffic from hosts running LangBot for signs of post-compromise abuse
• Track upstream reverse-proxy metrics (NGINX, Traefik) for anomalous concurrent request patterns

How to Mitigate CVE-2026-90562

Immediate Actions Required

• Upgrade LangBot to version 4.10.11 or later without delay
• Rotate the administrator password and any API credentials configured within LangBot after upgrading
• Restrict network exposure of the LangBot HTTP interface to trusted management networks or VPN
• Review recent administrator activity and configuration changes for signs of prior exploitation

Patch Information

The fix is delivered in LangBot 4.10.11 via commit 267232c24f93c515d6fd3f7f81c0676066ab1ab8. The patch increases recovery key entropy by using an eight-character alphabet of 32 unambiguous symbols (40 bits of entropy), introduces constant-time comparison via hmac, and adds throttling primitives. Refer to the VulnCheck Advisory on LangBot and LangBot Issue #2392 for additional context.

Workarounds

• Place LangBot behind a reverse proxy that enforces strict rate limiting on the reset-password path
• Restrict access to the administrative HTTP interface using firewall rules or an authenticated ingress
• Disable or firewall off the password recovery endpoint until the upgrade is applied
• Treat the administrator email address as sensitive information and avoid publishing it in public channels

# Example NGINX rate limit for the LangBot reset endpoint
limit_req_zone $binary_remote_addr zone=langbot_reset:10m rate=5r/m;

server {
    location /api/v1/user/reset-password {
        limit_req zone=langbot_reset burst=5 nodelay;
        limit_req_status 429;
        proxy_pass http://langbot_upstream;
    }
}