What is CVE-2026-90562?

CVE-2026-90562 is a high-severity vulnerability in Langbot-App Langbot, classified under Insufficient Entropy. CVSS score: 8.1/10. Published 2026-09-13.

How severe is CVE-2026-90562?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Langbot-App Langbot

CVE-2026-90562

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Langbot-app Langbot

Weakness classification (CWE)

CWE-331 — Insufficient Entropy

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-90562?: CVE-2026-90562 is a high-severity vulnerability in Langbot-App Langbot, classified under Insufficient Entropy. CVSS score: 8.1/10. Published 2026-09-13.
How severe is CVE-2026-90562?: High severity. CVSS v3 base score is 8.1 out of 10.