This vulnerability in AstrBotDevs AstrBot (versions up to 4.16.0) arises from hard-coded credentials within the Dashboard component's authentication route file (astrbot/dashboard/routes/auth.py). The presence of hard-coded credentials can allow remote attackers to bypass authentication controls and gain unauthorized access. The vulnerability is remotely exploitable without any required privileges or user interaction, increasing its risk. The CVSS 4.0 base score is 6.9, reflecting a medium severity impact. The vendor has been contacted but has not issued any advisory or patch, and no known exploits are reported in the wild at this time.

The vulnerability allows remote attackers to authenticate using hard-coded credentials, potentially leading to unauthorized access to the AstrBot Dashboard. This can compromise the confidentiality and integrity of the affected system. Since no privileges or user interaction are required, exploitation is straightforward once the hard-coded credentials are known. However, no known exploits in the wild have been reported yet.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should monitor the vendor's communications for any future updates. Until a fix is released, consider restricting network access to the Dashboard component to trusted hosts only and review deployment configurations to minimize exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.