GitHub Advisoryadvisory · PyPI
GHSA-mq9q-25hm-g4gp AstrBot Makes Use of Hard-coded Password
MEDIUM
Official page ↗
- Aliases
- CVE-2026-7579
- Ecosystem
- PyPI
- Packages
- AstrBot
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-259
- Reviewed
- 2026-05-07
Affected packages
• PyPI AstrBot: <= 4.16.0 (no fix yet)
Description
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Related
Alias · CVE (1)
- CVE-2026-7579 A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. vulnerability
Weakness · CWE (1)
- CWE-259 Use of Hard-coded Password weakness
References
- https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-vrqm-xcfv-286r web
- https://nvd.nist.gov/vuln/detail/CVE-2026-7579 advisory
- https://github.com/AstrBotDevs/AstrBot package
- https://github.com/Dave-gilmore-aus/security-advisories/blob/main/AstrBot-Security-Advisory web
- https://vuldb.com/submit/793437 web
- https://vuldb.com/vuln/360420 web
- https://vuldb.com/vuln/360420/cti web