Vulnerability · Published Feb 2, 2026 · Assigned by GitHub_M
CVE-2025-69207Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning
Medium 5.4
In plain English
A medium-severity authorization bypass via user-controlled key in khoj from khoj-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims' Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim's Khoj search index. This attack requires knowing the user's UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | khoj | no fix listed | GHSA-6whj-7qmg-86qj |
| PyPI | khoj | no fix listed | PYSEC-2026-1491 |
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
References
- https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj x_refsource_CONFIRM
- https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b x_refsource_MISC
- https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23 x_refsource_MISC