The vulnerability is an authentication bypass in Obot’s command‑line login flow. An unauthenticated user can create a token request through POST /api/token-request, then send the generated login link to a legitimate user. When that user accepts the link, the request returns a non‑expiring API key that the attacker can use to fully control the victim’s account. This mechanism allows the attacker to obtain credentials without knowledge of the user’s password, leading to full account takeover.

Versions of Obot prior to 0.26.0, including all releases of obot-platform:obot before the 0.26.0 update, are affected.

The CVSS score of 8.6 indicates a high severity authentication bypass. The vulnerability allows an unauthenticated attacker to create a token request, send the generated login link to a legitimate user, and obtain a non‑expiring API key that grants full control of the victim’s account. Because the API endpoint is reachable over the network and the exploit requires only a standard HTTP POST request, it can be performed by any adversary with network access to the affected system. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog.