CVE-2026-115333: Improper Authentication in uselotus lotus
Description
Lotus versions up to 0.10.2 have an improper authentication vulnerability in the Go event ingestion middleware. The API key validation only checks the prefix of the key, not the full secret, allowing attackers who know or obtain a key prefix to submit usage events on behalf of that organization. This can lead to manipulation of metered usage and billing data.
CVSS v4.0
Score 8.2high
Affected software
uselotus
lotus
pkg:golang/github.com/uselotus/lotusRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-115333 describes an improper authentication vulnerability in uselotus lotus through version 0.10.2. The flaw exists in the Go event ingestion middleware that validates API keys by prefix only, without verifying the full secret against the stored hashed key. As a result, an attacker with knowledge of an API key prefix can submit usage events to the POST /api/track/ endpoint impersonating the organization associated with that prefix. This allows alteration of metered usage and billing data, potentially causing financial or operational impact.
Potential Impact
An attacker who obtains or guesses an API key prefix can submit fraudulent usage events for an organization, leading to inaccurate metered usage reporting and potentially incorrect billing. This compromises the integrity of usage data and could result in financial loss or billing disputes.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to API key prefixes and monitor for suspicious usage event submissions. Avoid sharing API key prefixes publicly and consider additional validation or rate limiting on the /api/track/ endpoint.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T10:37:08.228Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad9f07a4d27ba8daa4bc4e9
Added to database: 10/22/2026, 11:16:10 UTC
Last enriched: 10/22/2026, 11:30:19 UTC
Last updated: 10/22/2026, 17:16:08 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.