PT-2026-59063 · Pypi · Astrbot

Published 2026-07-13 · Updated 2026-07-13

OSV

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr main agent of the file astrbot/core/astr main agent.py. Such manipulation of the argument session id leads to authorization bypass. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Fix

Related Identifiers

PYSEC-2026-2383

Affected Products

Astrbot

References · 10

• https://osv.dev/vulnerability/PYSEC-2026-2383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10212 · Security Note
• https://github.com/AstrBotDevs/AstrBot · Note
• https://vuldb.com/vuln/367491/cti · Note
• https://gist.github.com/YLChen-007/91a7f955143099e1747424707dfad0f9 · Note
• https://github.com/advisories/GHSA-r6vm-4xwg-w69h · Note
• https://vuldb.com/vuln/367491 · Note
• https://pypi.org/project/astrbot · Note
• https://vuldb.com/submit/821923 · Note
• https://vuldb.com/cve/CVE-2026-10212 · Note