What is GHSA-p9v9-jrq9-jpjv?

GHSA-p9v9-jrq9-jpjv is a security advisory published by GitHub Security Advisories with High severity. Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that...

Which CVE IDs does GHSA-p9v9-jrq9-jpjv cover?

GHSA-p9v9-jrq9-jpjv covers the following CVE IDs: CVE-2026-114662. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p9v9-jrq9-jpjv?

GHSA-p9v9-jrq9-jpjv has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-p9v9-jrq9-jpjvHighCVSS 8.1

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-114662 →

📋 Description

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.

🔗 References (4)

https://github.com/obot-platform/obot/security/advisories/GHSA-2qcm-3gv6-2mfc
https://nvd.nist.gov/vuln/detail/CVE-2026-114662
https://www.vulncheck.com/advisories/obot-before-0.26.0-api-key-theft-via-cli-login-token-request
https://github.com/advisories/GHSA-p9v9-jrq9-jpjv