CVE-2026-90562: Langbot-App Langbot

High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days.

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

Affected products

• Langbot-App Langbot: from 4.0.8.1, before 4.10.11 (fixed in 4.10.11)

Published 2026-09-13. Last modified 2026-09-23.