This vulnerability affects AstrBotDevs AstrBot up to version 4.25.5. It is located in the OpenApiRoute.chat_send function within the astrbot/dashboard/routes/open_api.py file. By manipulating the Username parameter, an attacker can spoof authentication remotely, bypassing normal access controls. The issue has been publicly disclosed with an available exploit, but no official remediation or patch has been provided by the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to bypass authentication controls remotely by spoofing the Username argument. This could enable unauthorized access to the API functions that require authentication. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS 4.0 score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider implementing additional access controls or network-level restrictions to limit exposure of the vulnerable API endpoint.