# CVE-2026-10212: AstrBotDevs AstrBot authorization bypass via delimiter injection in session_id

Source: https://junglewise.ai/threats/cve-2026-10212-astrbotdevs-astrbot-authorization-bypass-via-delimiter-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-10212 · Severity: medium · CVSS 6.3 · Published 2026-06-01

AstrBot, a chatbot framework, contains a security flaw in how it handles user chat sessions. An authenticated attacker can manipulate session identifiers to trick the system into modifying or interacting with another user's chat session. This could lead to unauthorized changes to session metadata, such as renaming chat titles, and potentially disrupt user isolation and data integrity.

Technologies: [astrbot (PyPI)](https://junglewise.ai/threats/technologies/astrbot). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-10212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10212 being exploited in the wild.

**How severe is CVE-2026-10212?** Medium severity, with a CVSS score of 6.3, published 1 June 2026.

**Which products and versions are affected?** astrbot (PyPI) <= 4.24.2, ECOSYSTEM:introduced=0,last_affected=4.24.2.

**Is there a fix for CVE-2026-10212?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10212 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10212?** Check whether you run astrbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in `astrbot/core/astr_main_agent.py` due to unsafe string parsing of the `session_id` parameter. The application uses a delimiter (`!`) to concatenate session information and subsequently extracts the ID using `.split("!")[-1]`. Because the user-supplied `session_id` is not sanitized for the delimiter character, an attacker can inject a crafted string (e.g., `attacker!victim_session_id`) to force the backend to resolve to a victim's session ID. This allows an authenticated remote attacker to perform unauthorized actions, such as renaming session titles via the `//rename` command, affecting data integrity. As of the advisory date, no patch has been released by the vendor.

## Affected products

- AstrBotDevs AstrBot <= 4.24.2

## Identifiers

- CVE-2026-10212
- GHSA-r6vm-4xwg-w69h
- PYSEC-2026-2383

## Timeline

- 2026-05-06: disclosed: Initial researcher disclosure via GitHub Gist
- 2026-06-01: advisory: GitHub Advisory and NVD publication

## References

- [https://gist.github.com/YLChen-007/91a7f955143099e1747424707dfad0f9](https://gist.github.com/YLChen-007/91a7f955143099e1747424707dfad0f9)
- [https://vuldb.com/cve/CVE-2026-10212](https://vuldb.com/cve/CVE-2026-10212)
- [https://vuldb.com/submit/821923](https://vuldb.com/submit/821923)
- [https://vuldb.com/vuln/367491](https://vuldb.com/vuln/367491)
- [https://vuldb.com/vuln/367491/cti](https://vuldb.com/vuln/367491/cti)

## Related threats

- [PYSEC-2026-1196 - AstrBot Has Path Traversal Vulnerability in /api/chat/get_file](https://junglewise.ai/threats/cve-2025-48957-astrbot-has-path-traversal-vulnerability-in-api-chat-get-file)
- [AstrBotDevs AstrBot path traversal in file upload handler](https://junglewise.ai/threats/cve-2026-8754-astrbotdevs-astrbot-path-traversal-in-file-upload-handler)
- [AstrBotDevs AstrBot hardcoded JWT secret key](https://junglewise.ai/threats/cve-2025-55449-astrbot-hard-coded-jwt-key-authentication-bypass-and-rce)
- [PYSEC-2026-2382 - AstrBot Makes Use of Hard-coded Password](https://junglewise.ai/threats/cve-2026-7579-astrbot-makes-use-of-hard-coded-password)
- [PYSEC-2026-2381 - AstrBot has Incomplete Filtering of Special Elements](https://junglewise.ai/threats/cve-2026-6984-astrbot-has-incomplete-filtering-of-special-elements)