CVE-2026-90562 affects LangBot before version 4.10.11. The vulnerability arises because password recovery keys are generated with insufficient entropy (24 bits), making them guessable through brute force. Additionally, the unauthenticated reset-password endpoint does not implement rate limiting, enabling attackers to rapidly attempt many keys. An attacker who knows the administrator's email can exploit this to exhaust the keyspace and reset the administrator password, thereby gaining unauthorized access.

An attacker can gain unauthorized administrative access by exploiting the weak entropy in password recovery keys combined with the lack of rate limiting on the reset-password endpoint. This compromises account security and potentially the entire system managed by the administrator.

A fix is available in LangBot version 4.10.11 and later. Users should upgrade to version 4.10.11 or newer to address this vulnerability. Until then, implementing rate limiting on the reset-password endpoint and increasing entropy for recovery keys can reduce risk.