CVE-2025-69207

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-69207
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69207.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-69207
Aliases
Published
2026-02-02T21:16:49.041Z
Modified
2026-03-14T12:44:46.594545Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning
Details

Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims' Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim's Khoj search index. This attack requires knowing the user's UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69207.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/khoj-ai/khoj

Affected ranges

Type
GIT
Repo
https://github.com/khoj-ai/khoj
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1b7ccd141d47f365edeccc57d7316cb0913d748b
Type
GIT
Repo
https://github.com/khoj-ai/khoj
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b607a6187ee6efd7213331222bd03b781ecc3213

Affected versions

0.*
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
0.12.1
0.12.2
0.12.3
0.13.0
0.14.0
0.2.1
0.2.5
0.2.6
0.3.0
0.4.0
0.5.0
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
1.*
1.0.0
1.0.1
1.1.0
1.10.0
1.10.1
1.10.2
1.11.0
1.11.1
1.11.2
1.12.0
1.12.1
1.13.0
1.14.0
1.15.0
1.16.0
1.17.0
1.2.0
1.2.1
1.20.0
1.20.1
1.20.2
1.20.3
1.20.4
1.21.0
1.21.1
1.21.2
1.21.3
1.21.4
1.21.5
1.21.6
1.22.0
1.22.1
1.22.2
1.22.3
1.23.0
1.23.1
1.23.2
1.23.3
1.24.0
1.24.1
1.25.0
1.26.0
1.26.1
1.26.2
1.26.3
1.26.4
1.27.0
1.27.1
1.28.0
1.28.1
1.28.2
1.28.3
1.29.0
1.29.1
1.3.0
1.30.0
1.30.1
1.30.10
1.30.2
1.30.3
1.30.4
1.30.5
1.30.6
1.30.7
1.30.8
1.30.9
1.31.0
1.32.0
1.32.1
1.32.2
1.33.0
1.33.1
1.33.2
1.34.0
1.35.0
1.35.1
1.35.2
1.35.3
1.36.0
1.36.1
1.36.2
1.36.3
1.36.4
1.36.5
1.36.6
1.37.0
1.37.1
1.37.2
1.38.0
1.39.0
1.4.0
1.40.0
1.41.0
1.42.0
1.42.1
1.42.2
1.42.3
1.42.4
1.42.5
1.42.6
1.42.7
1.42.8
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.8.0
1.9.0
2.*
2.0.0-beta.1
2.0.0-beta.10
2.0.0-beta.11
2.0.0-beta.12
2.0.0-beta.13
2.0.0-beta.14
2.0.0-beta.15
2.0.0-beta.16
2.0.0-beta.17
2.0.0-beta.18
2.0.0-beta.19
2.0.0-beta.2
2.0.0-beta.20
2.0.0-beta.21
2.0.0-beta.22
2.0.0-beta.3
2.0.0-beta.4
2.0.0-beta.5
2.0.0-beta.6
2.0.0-beta.7
2.0.0-beta.8
2.0.0-beta.9
Other
rm
v0.*
v0.1.5-alpha
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69207.json"