CVE-2026-16076

MEDIUM

AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing

Title source: cna

Description

A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the argument Username leads to authentication bypass by spoofing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-379791 | AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing

https://vuldb.com/vuln/379791

Exploit exploit

https://gist.github.com/YLChen-007/080ba55a71588dbbba3f27afed4c072c

Signature, Permissions Required signature permissions-required

VDB-379791 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/379791/cti

Third Party Advisory third-party-advisory

CVE-2026-16076 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-16076

Third Party Advisory third-party-advisory

Submit #852864 | AstrBotDevs AstrBot <= 4.25.5 Authentication Bypass by Spoofing (CWE-290)

https://vuldb.com/submit/852864

Scores

CVSS v3 6.3

EPSS 0.0029

EPSS Percentile 21.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-287 CWE-290

Status published

Products (6)

AstrBotDevs/AstrBot 4.25.0

AstrBotDevs/AstrBot 4.25.1

AstrBotDevs/AstrBot 4.25.2

AstrBotDevs/AstrBot 4.25.3

AstrBotDevs/AstrBot 4.25.4

AstrBotDevs/AstrBot 4.25.5

Published Jul 18, 2026

Tracked Since Jul 18, 2026