botframework-connector vulnerable to Improper AuthenticationGHSA-cqff-fx2x-p86v
MEDIUMGHSA-cqff-fx2x-p86v is a medium-severity (CVSS 5.3) Improper Authentication vulnerability in botframework-connector. A fix is available for botframework-connector — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-cqff-fx2x-p86v by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
botframework-connector🐍botframework-connector🐍botframework-connector🐍botframework-connectorReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Impact
A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot.
Patches
The problem has been patched in all affected versions. Please see the list of patched versions for the most appropiate one for your individual case.
Workarounds
Users who do not wish or are not able to upgrade can add an authentication configuration containing ClaimsValidator, which throws an exception if Claims are Skill Claims.
For detailed instructions, see the link in the References section.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Microsoft Bot Builder SDK
- Email us at [email protected]
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | botframework-connector | ≥ 4.7.0&&< 4.7.2 | 4.7.2pip install --upgrade 'botframework-connector==4.7.2' |
| 🐍PyPI | botframework-connector | ≥ 4.8.0&&< 4.8.1 | 4.8.1pip install --upgrade 'botframework-connector==4.8.1' |
| 🐍PyPI | botframework-connector | ≥ 4.9.0&&< 4.9.3 | 4.9.3pip install --upgrade 'botframework-connector==4.9.3' |
| 🐍PyPI | botframework-connector | ≥ 4.10.0&&< 4.10.1 | 4.10.1pip install --upgrade 'botframework-connector==4.10.1' |
Affected Products
bot framework software development kitmicrosoftDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for botframework-connector, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update botframework-connector to 4.7.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-cqff-fx2x-p86v is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is GHSA-cqff-fx2x-p86v in your dependencies?
Find it across PyPI, including transitive dependencies.