CVE-2026-90562
LangBot versions before 4.10.11 generate password recovery keys with only 24 bits of entropy and expose an unauthenticated reset‑password endpoint without rate limiting. This allows attackers who know the administrator’s email to brute‑force the recovery key and reset the admin password. The result is full administrative access to the system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
LangBot software, versions earlier than 4.10.11, used by administrators who rely on password recovery functionality.
Real-world impact
An attacker can reset the administrator password and gain complete control over the application, compromising all data and operations.
Why this severity
The CVSS score of 9.2 reflects the high impact on confidentiality, integrity, and availability, combined with low attack complexity and no required privileges. The vulnerability allows remote attackers to fully compromise the system without user interaction.
What to do about it
- ›Disable or restrict the reset‑password endpoint until a patch is available.
- ›Implement rate limiting on the reset‑password endpoint to slow brute‑force attempts.
- ›Change the administrator password immediately and use a strong, unique password.
- ›Consider disabling password recovery for critical accounts if possible.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description