PYSEC-2026-2382

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/astrbot/PYSEC-2026-2382.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-2382
Aliases
Published
2026-07-13T15:02:55.937569Z
Modified
2026-07-13T16:43:46.452971837Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
AstrBot Makes Use of Hard-coded Password
Details

A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Affected packages

PyPI / astrbot

Package

Name
astrbot
View open source insights on deps.dev
Purl
pkg:pypi/astrbot

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
4.16.0

Affected versions

3.*
3.4.39
3.5.6
3.5.7
3.5.8
3.5.9
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.15
3.5.17
3.5.18
3.5.19
3.5.20
3.5.21
3.5.22
3.5.23
3.5.24
3.5.25
3.5.26
3.5.27
4.*
4.0.0b1
4.0.0b2
4.0.0b3
4.0.0b4
4.0.0b5
4.0.0
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.3.5
4.5.0
4.5.1
4.5.2
4.5.3
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.7.0
4.7.1
4.7.3
4.7.4
4.8.0
4.9.0
4.9.1
4.9.2
4.10.0a1
4.10.0a2
4.10.0
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.11.0
4.11.1
4.11.2
4.11.3
4.11.4
4.12.0
4.12.1
4.12.2
4.12.3
4.12.4
4.13.0
4.13.1
4.13.2
4.14.0
4.14.1
4.14.2
4.14.3
4.14.4
4.14.5
4.14.6
4.14.7
4.14.8
4.15.0
4.16.0

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/astrbot/PYSEC-2026-2382.yaml"