{"vulnerability": "CVE-2026-90562", "sightings": [{"uuid": "ea74ae3d-079f-47fa-85f0-f327f3d0ff0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90562", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117263618841865453", "content": "LangBot <4.10.11 is affected by CRITICAL CVE-2026-90562: password reset keys generated with only 24 bits of entropy & no rate limiting let attackers brute-force admin resets. Upgrade to 4.10.11+! https://radar.offseq.com/threat/cve-2026-90562-insufficient-entropy-in-langbot-app-langbot-e9a2899a1e2d1fa5 #OffSeq #CVE202690562 #infosec #AppSec", "creation_timestamp": "2026-09-13T12:00:25.742219Z"}, {"uuid": "d5d51e8b-7890-4f2f-9eb8-1fccdd65fac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-90562", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvfkc44rgx2p", "content": "LangBot 4.0.8.1 \u2013 4.10.10 has a CRITICAL flaw: weak password reset keys & no rate limiting enable admin password takeovers. Upgrade to 4.10.11+ ASAP. https://radar.offseq.com/threat/cve-2026-90562-insufficient-entropy-in-langbot-app-langbot-e9a2899a1e2d1fa5 #OffSeq #CVE202690562 #AppSec", "creation_timestamp": "2026-09-13T12:00:27.175390Z"}, {"uuid": "ab01e392-5f5d-4fc9-a399-18aca3b03060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90562", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvfkoc5v7y2f", "content": "\ud83d\udea8 CVE-2026-90562 \u2014 CVSS 9.2 CRITICAL\n\nLangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate li...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-90562\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-13T12:07:15.798572Z"}, {"uuid": "6f9bdd4f-3244-4ae7-ad28-c5db199c5f87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90562", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfnpxbamg2o", "content": "\ud83d\udfe0 CVE-2026-90562 - High (8.1)\n\nLangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-90562/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-13T13:02:03.753457Z"}, {"uuid": "1cde1a38-2e8f-450b-b402-1c470c63c39a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90562", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvfpub3t6j2j", "content": "CVE-2026-90562 - langbot\nVersions of LangBot before 4.10.11 create password\u2011reset keys that are easy to guess and do not limit how often the reset function can be called. If an attacker knows the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#langbot #langbotapp #CVE #infosec", "creation_timestamp": "2026-09-13T13:40:05.036966Z"}, {"uuid": "cdd4f469-5488-4301-80c2-6006c80faac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-90562", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvmmfzr2il2l", "content": "LangBot CVE-2026-90562 (CVSS 9.2) uses 24-bit recovery keys and no rate limiting \u2014 attackers can reset admin passwords. Patch to 4.10.11 now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-16T07:27:04.055902Z"}]}