CVE-2026-90562

LangBot versions before 4.10.11 generate password-recovery keys with only 24 bits of entropy and expose the reset-password endpoint without authentication or rate limiting (CWE-331). An unauthenticated remote attacker who knows the administrator's email address can send concurrent reset requests to exhaust the roughly 16.7 million possible keys and set a new admin password. Successful exploitation yields full control of the LangBot administrator account, with high impact on confidentiality, integrity, and availability reflected in the CVSS 4.0 score of 9.2 (critical). Any self-hosted LangBot instance running a version earlier than 4.10.11 is affected, especially deployments where the web console is reachable over a network. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported at this time.

What to do: Upgrade to LangBot 4.10.11 or later as soon as possible. Until patched, restrict network access to the admin console and password-reset endpoint (VPN, firewall rules, or a reverse proxy with authentication and rate limiting), and verify the administrator email is not publicly discoverable. Review logs for bursts of password-reset requests from unfamiliar sources and rotate the admin credential if any suspicious activity is found.