AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials_CVE-2026-7579

6.9 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Description

A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Basic Information

ID CVE-2026-7579

Source VulDB

Published May 1, 2026 at 11:30

Affected Product

Vendor AstrBotDevs

Product AstrBot

Version 4.0

Affected Versions AstrBotDevs AstrBot 4.0
AstrBotDevs AstrBot 4.1
AstrBotDevs AstrBot 4.2
AstrBotDevs AstrBot 4.3
AstrBotDevs AstrBot 4.4
AstrBotDevs AstrBot 4.5
AstrBotDevs AstrBot 4.6
AstrBotDevs AstrBot 4.7
AstrBotDevs AstrBot 4.8
AstrBotDevs AstrBot 4.9
AstrBotDevs AstrBot 4.10
AstrBotDevs AstrBot 4.11
AstrBotDevs AstrBot 4.12
AstrBotDevs AstrBot 4.13
AstrBotDevs AstrBot 4.14
AstrBotDevs AstrBot 4.15
AstrBotDevs AstrBot 4.16.0

CWE Classification

CWE-798 CWE-259

References

{
    "lastseen": "",
    "description": "A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
    "published": "2026-05-01T11:30:15.357Z",
    "modified": "2026-05-01T11:30:15.357Z",
    "type": "cve",
    "title": "AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials",
    "source": "VulDB",
    "references": "https://vuldb.com/vuln/360420\nhttps://vuldb.com/vuln/360420/cti\nhttps://vuldb.com/submit/793437\nhttps://github.com/Dave-gilmore-aus/security-advisories/blob/main/AstrBot-Security-Advisory\nhttps://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-vrqm-xcfv-286r\nhttps://github.com/AstrBotDevs/AstrBot/",
    "id": "CVE-2026-7579",
    "bulletinFamily": "",
    "cwe": [
        "CWE-798",
        "CWE-259"
    ],
    "cvelist": null,
    "sourceData": "AstrBotDevs AstrBot 4.0\nAstrBotDevs AstrBot 4.1\nAstrBotDevs AstrBot 4.2\nAstrBotDevs AstrBot 4.3\nAstrBotDevs AstrBot 4.4\nAstrBotDevs AstrBot 4.5\nAstrBotDevs AstrBot 4.6\nAstrBotDevs AstrBot 4.7\nAstrBotDevs AstrBot 4.8\nAstrBotDevs AstrBot 4.9\nAstrBotDevs AstrBot 4.10\nAstrBotDevs AstrBot 4.11\nAstrBotDevs AstrBot 4.12\nAstrBotDevs AstrBot 4.13\nAstrBotDevs AstrBot 4.14\nAstrBotDevs AstrBot 4.15\nAstrBotDevs AstrBot 4.16.0",
    "sourceHref": "",
    "cvss": {
        "score": 6.9,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "AstrBot",
    "version": "4.0",
    "vendor": "AstrBotDevs",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}