CVE-2023-2886: Cbot Core

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

Affected products

• Cbot Cbot Core: before 4.0.3.4 (fixed in 4.0.3.4)
• Cbot Cbot Panel: before 4.0.3.7 (fixed in 4.0.3.7)

Published 2023-05-25. Last modified 2026-06-17.