LangBot's plugin runtime (pip package langbot_plugin) versions up to 0.4.17 start a debug WebSocket server on 0.0.0.0:5401 with authentication gated by plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose. Consequently, authentication is effectively disabled, allowing any remote attacker able to reach the port to register arbitrary debug plugins without credentials. Because events are broadcast to all initialized plugins without filtering, an attacker's plugin receives the full context of every instant message event, including private chats and user/sender IDs in plaintext. The attacker can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured large language models, read knowledge-base contents, and register malicious tools that feed every user's LLM pipeline. Registering a plugin with "prod_mode": true causes legitimate installations of plugins with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication.

An attacker with network access to the debug WebSocket port can bypass authentication to fully control debug plugins, gaining access to sensitive instant message data including private chats and user identifiers. The attacker can impersonate bots, manipulate message flows, invoke language models, and access knowledge bases. Additionally, the attacker can cause persistent denial of service by blocking legitimate plugin registrations. This represents a high-severity risk to confidentiality, integrity, and availability of the LangBot system.

No official patch or fix was available at the time of disclosure. Users should restrict network access to port 5401 to trusted hosts only, disable or avoid using the debug WebSocket server, or apply custom configuration to set a non-empty plugin_debug_key if possible. Monitor vendor advisories for updates and patches addressing this vulnerability.