CVE-2026-5557

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5557", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-04T13:50:06.661Z", "datePublished": "2026-04-05T09:45:15.859Z", "dateUpdated": "2026-04-06T14:50:53.417Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-05T09:45:15.859Z"}, "title": "badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-288", "lang": "en", "description": "Authentication Bypass Using Alternate Channel"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "badlogic", "product": "pi-mono", "versions": [{"version": "0.58.0", "status": "affected"}, {"version": "0.58.1", "status": "affected"}, {"version": "0.58.2", "status": "affected"}, {"version": "0.58.3", "status": "affected"}, {"version": "0.58.4", "status": "affected"}], "modules": ["pi-mom Slack Bot"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-04T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-04T15:55:11.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Yu Bao (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/355327", "name": "VDB-355327 | badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355327/cti", "name": "VDB-355327 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/782879", "name": "Submit #782879 | badlogic pi-mono 0.58.4 Unauthenticated Remote Code Execution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/August829/CVEP/issues/28", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T14:33:56.834843Z", "id": "CVE-2026-5557", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T14:50:53.417Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5557", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T14:33:56.834843Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T14:33:57.870Z"}}], "cna": {"title": "badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass", "credits": [{"lang": "en", "type": "reporter", "value": "Yu Bao (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "badlogic", "modules": ["pi-mom Slack Bot"], "product": "pi-mono", "versions": [{"status": "affected", "version": "0.58.0"}, {"status": "affected", "version": "0.58.1"}, {"status": "affected", "version": "0.58.2"}, {"status": "affected", "version": "0.58.3"}, {"status": "affected", "version": "0.58.4"}]}], "timeline": [{"lang": "en", "time": "2026-04-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-04T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-04T15:55:11.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/355327", "name": "VDB-355327 | badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/355327/cti", "name": "VDB-355327 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/782879", "name": "Submit #782879 | badlogic pi-mono 0.58.4 Unauthenticated Remote Code Execution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/August829/CVEP/issues/28", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "Authentication Bypass Using Alternate Channel"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-05T09:45:15.859Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5557", "state": "PUBLISHED", "dateUpdated": "2026-04-06T14:50:53.417Z", "dateReserved": "2026-04-04T13:50:06.661Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-05T09:45:15.859Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["pi-mom Slack Bot"], "product": "pi-mono", "vendor": "badlogic", "versions": [{"status": "affected", "version": "0.58.0"}, {"status": "affected", "version": "0.58.1"}, {"status": "affected", "version": "0.58.2"}, {"status": "affected", "version": "0.58.3"}, {"status": "affected", "version": "0.58.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en badlogic pi-mono hasta la versi\u00f3n 0.58.4. Este problema afecta a alg\u00fan procesamiento desconocido del archivo packages/mom/src/slack.ts del componente pi-mom Slack Bot. La manipulaci\u00f3n resulta en omisi\u00f3n de autenticaci\u00f3n utilizando un canal alternativo. El ataque puede ser ejecutado remotamente. El exploit es ahora p\u00fablico y puede ser utilizado. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-5557", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5557", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T14:33:56.834843Z", "version": "2.0.3"}}]}, "published": "2026-04-05T10:16:19.720", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/August829/CVEP/issues/28"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/782879"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355327"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355327/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-288"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.58.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.58.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.58.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.58.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.58.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pi-mono", "source": "cna", "vendor": "badlogic"}, "product": "pi-mono", "vendor": "badlogic"}], "analysis": {"en": {"generated_at": "2026-04-05T13:21:06.882892+00:00", "value": {"mitigation_remediation": ["Apply any available update that removes the authentication bypass in packages/mom/src/slack.ts", "If updating is not immediately possible, restrict network access to the bot's communication endpoints to prevent remote exploitation", "Continuously monitor Slack channel activity and authentication logs for unexpected access patterns"], "summary": {"action": "Patch", "impact": "Authentication bypass leading to unauthorized bot access"}, "threat_synthesis": {"affected_systems": "Affected software is badlogic pi-mono, specifically the pi-mom Slack Bot component, in all versions up to and including 0.58.4.", "description_and_impact": "The vulnerability allows an attacker to bypass authentication by manipulating the Slack bot's handling of the packages/mom/src/slack.ts file. This results in an alternate channel being authorized without valid credentials, enabling unauthorized access to bot functionality.", "risk_and_exploitability": "The CVSS base score of 5.3 indicates moderate risk. With no EPSS data and no listing in KEV, the likelihood of widespread exploitation is unclear, but the remote nature of the attack means a determined threat actor could exploit it to gain unauthorized control of the Slack Bot. No official vendor fix has been released yet."}}}}, "created": "2026-04-06T20:26:22.480111+00:00", "updated": "2026-04-06T21:56:56.567162+00:00", "vendors": ["badlogic", "badlogic$PRODUCT$pi-mono"]}