@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

Description

No description available.

Recommendation

Update the @eeacms/volto-chatbot package to the latest compatible version. Followings are version details:

Affected version(s): <= 2.0.3
Patched version(s): 2.0.4

References

Could your website be exposed too?

SmartScanner can check your website for @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy and gives you actionable findings to investigate.

Start a free scan

Related Issues

MCP Connect has unauthenticated remote OS command execution via /bridge endpoint - Vulnerability
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass - CVE-2026-45577
SillyTavern has a SSRF vulnerability in the CORS proxy middleware - CVE-2026-44652
Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated October 29, 2026