PT-2025-47033 · Astrbot+1 · Astrbot

Published 2025-11-14 · Updated 2026-05-12 · CVE-2025-55449

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AstrBot version 3.5.15

Description The software uses a hard-coded private key, "Advanced System for Text Response and Bot Operations Tool", to sign JSON Web Tokens (JWT), which are compact, URL-safe means of representing claims to be transferred between two parties. This allows attackers to bypass authentication and install a malicious Python plugin, leading to arbitrary command execution on the target host.

Recommendations Update to a version released after 2025-06-21.

Exploit

Fix

Insufficient Verification of Data Authenticity

Using Hardcoded Credentials

Weakness Enumeration

CWE-345

CWE-798

CWE-321

Related Identifiers

CVE-2025-55449

GHSA-4M32-CJV7-F425

Affected Products

Astrbot

References · 14

• 🔥 https://github.com/Marven11/CVE-2025-55449-AstrBot-RCE · Exploit
• https://osv.dev/vulnerability/GHSA-4m32-cjv7-f425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55449 · Security Note
• https://github.com/AstrBotDevs/AstrBot · Note
• https://github.com/AstrBotDevs/AstrBot/commit/d03e9fb90a0921a1bd10cf480bdacc9aaa246472 · Note
• https://github.com/AstrBotDevs/AstrBot/releases/tag/v3.5.18 · Note
• https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-4m32-cjv7-f425 · Note
• https://reddit.com/r/VulnMatter/comments/1oxcbz9/resumen_diario_de_vulnerabilidades_14112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p0kjng/resumen_diario_de_vulnerabilidades_18112025 · Reddit Post
• https://t.me/cveNotify/162680 · Telegram Post
• https://t.me/CVEtracker/53091 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ozp1t6/resumen_diario_de_vulnerabilidades_17112025 · Reddit Post
• https://twitter.com/CVEnew/status/2053559168250818852 · Twitter Post
• https://t.me/cveNotify/163216 · Telegram Post