Prior to version 0.2.1, Nanobot’s Microsoft Teams channel handler blindly follows any serviceUrl supplied in an incoming activity. An attacker can forge the serviceUrl field so that it points to an attacker‑controlled endpoint. When the bot later replies on the same conversation, the framework includes the stored Authorization header containing a bearer token, causing the bot to send that token to the attacker’s host. The result is a server‑side request forgery that exposes confidential Bot Framework credentials and allows the attacker to perform authenticated actions on the bot’s behalf. This vulnerability is categorized as CWE‑918: Server‑Side Request Forgery.

The vulnerability affects the Nanobot project of the HKUDS organization. All releases prior to 0.2.1 are vulnerable; version 0.2.1 and later contain the fix.

The CVSS score of 7 indicates a high severity. No EPSS data is available, so the exploitation probability cannot be precisely quantified, but the attack does not require privileged access and can be triggered via the Teams webhook endpoint. The vulnerability is not listed in CISA’s KEV catalog. Attackers can execute the exploitation remotely by sending a crafted activity to the Teams webhook URL; no credentials or local installation are needed.