CVE-2026-90562 langbot-app CVE debrief

Who should care

Defenders and administrators of LangBot installations should assess exposure and prioritize verification and remediation efforts. This includes verifying LangBot versions, implementing rate limiting on the reset-password endpoint, and monitoring for suspicious password reset attempts. Additionally, defenders should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-90562 is a critical vulnerability in LangBot before 4.10.11 that allows remote attackers to gain account access through weak password recovery keys and lack of rate limiting on the reset-password endpoint. Defenders and administrators of LangBot installations should assess exposure and prioritize verification and remediation.

• Remote attackers can exhaust the keyspace and gain account access through concurrent requests to reset the admin password
• Lack of rate limiting on the reset-password endpoint allows for brute-force attacks
• Weak password recovery keys with only 24 bits of entropy can be easily exhausted

Technical summary

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access. This vulnerability is critical because it allows attackers to exploit weak password recovery keys and lack of rate limiting, enabling them to gain unauthorized access to LangBot installations. Defenders should prioritize verifying LangBot versions and upgrading to 4.10.11 or later.

Defensive priority

Defenders should prioritize verifying LangBot versions and upgrading to 4.10.11 or later, implementing rate limiting on the reset-password endpoint, and monitoring for suspicious password reset attempts.

Recommended defensive actions

• Verify LangBot versions and upgrade to 4.10.11 or later
• Implement rate limiting on the reset-password endpoint
• Monitor for suspicious password reset attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate that LangBot before 4.10.11 has a critical vulnerability due to weak password recovery keys and lack of rate limiting on the reset-password endpoint. The vulnerability allows remote attackers to exhaust the keyspace and gain account access through concurrent requests to reset the admin password. Evidence is based on CVE metadata and source-provided information, which may have limitations in scope and detail. Defenders should verify LangBot versions and assess exposure based on available 3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.