# CVE-2026-16076: AstrBotDevs AstrBot authentication bypass via spoofing in OpenAPI

Source: https://junglewise.ai/threats/cve-2026-16076-astrbotdevs-astrbot-authentication-bypass-via-spoofing-in-openapi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-18. Updated: 2026-07-18  
License: CC BY 4.0 with a link back

CVE-2026-16076 · Severity: medium · CVSS 6.3 · Published 2026-07-18

AstrBot is a chatbot management platform and dashboard. A security flaw in its API allows users with basic chat permissions to impersonate an administrator by spoofing their username in specific requests. This allows an attacker to execute administrative commands, potentially leading to unauthorized configuration changes or access to sensitive system functions.

## Quick answers

**Is CVE-2026-16076 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16076 being exploited in the wild.

**How severe is CVE-2026-16076?** Medium severity, with a CVSS score of 6.3, published 18 July 2026.

**Which products and versions are affected?** AstrBotDevs AstrBot up to 4.25.5.

**Is there a fix for CVE-2026-16076?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16076 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-16076?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass by spoofing (CWE-290) exists in AstrBot up to version 4.25.5. The vulnerability is located in the `OpenApiRoute.chat_send` function within `astrbot/dashboard/routes/open_api.py`. While the API-key middleware initially authenticates the caller, the `chat_send` handler subsequently overwrites the trusted principal (`g.username`) with an untrusted `username` value provided in the JSON request body. This spoofed identity is then propagated to the message pipeline, where authorization checks for administrative commands are performed based on the sender ID. An attacker with a valid 'chat' scope API key can set their username to a known administrator ID (e.g., 'astrbot') to execute restricted commands. As of the advisory date, the vendor has not responded to the disclosure.

## Affected products

- AstrBotDevs AstrBot up to 4.25.5

## Timeline

- 2026-06-09: disclosed: Initial disclosure via GitHub Gist by researcher YLChen-007
- 2026-07-18: advisory: NVD/VulDB publication date

## References

- [https://gist.github.com/YLChen-007/080ba55a71588dbbba3f27afed4c072c](https://gist.github.com/YLChen-007/080ba55a71588dbbba3f27afed4c072c)
- [https://vuldb.com/cve/CVE-2026-16076](https://vuldb.com/cve/CVE-2026-16076)
- [https://vuldb.com/submit/852864](https://vuldb.com/submit/852864)
- [https://vuldb.com/vuln/379791](https://vuldb.com/vuln/379791)
- [https://vuldb.com/vuln/379791/cti](https://vuldb.com/vuln/379791/cti)