A vulnerability in AstrBotDevs AstrBot allows an attacker to gain unauthorized access by exploiting hard‑coded credentials present in the auth.py file of the Dashboard component. The weakness corresponds to CWE-259 and CWE-798 and enables an attacker to log in without knowledge of any user credentials. This elevates the confidentiality and integrity exposure for systems using the affected version by granting full administrative control over the dashboard and its underlying services.

The issue affects AstrBotDevs AstrBot releases up to and including 4.16.0. The vulnerability resides in the Dashboard module, which is commonly deployed as the central web interface for AstrBot. Instances of AstrBot running in any environment—cloud, on‑premises, or edge—are potentially impacted if they have not applied a fix or upgraded to a later release.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, as public disclosures state that the exploit can be initiated externally. An attacker can exploit the hard‑coded credentials to access the dashboard from any network that can reach the service, provided no network restrictions are in place. Once accessed, the attacker can manipulate settings, view logs, and potentially compromise other components of the AstrBot installation.