Vulnerability-Lookup

CVE-2025-69207 (GCVE-0-2025-69207)

Vulnerability from cvelistv5 – Published: 2026-02-02 21:16 – Updated: 2026-02-03 15:45

Title

Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning

Summary

Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims' Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim's Khoj search index. This attack requires knowing the user's UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M

References

URL

Tags

	https://github.com/khoj-ai/khoj/security/advisori…	x_refsource_CONFIRM
	https://github.com/khoj-ai/khoj/commit/1b7ccd141d…	x_refsource_MISC
	https://github.com/khoj-ai/khoj/releases/tag/2.0.…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	khoj-ai	khoj	Affected: < 2.0.0-beta.23

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69207",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:44:16.914965Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:45:38.393Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "khoj",
          "vendor": "khoj-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.0-beta.23"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user\u0027s Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims\u0027 Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim\u0027s Khoj search index. This attack requires knowing the user\u0027s UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-02T21:16:49.041Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj"
        },
        {
          "name": "https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b"
        },
        {
          "name": "https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23"
        }
      ],
      "source": {
        "advisory": "GHSA-6whj-7qmg-86qj",
        "discovery": "UNKNOWN"
      },
      "title": "Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69207",
    "datePublished": "2026-02-02T21:16:49.041Z",
    "dateReserved": "2025-12-29T14:54:59.520Z",
    "dateUpdated": "2026-02-03T15:45:38.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-69207\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-02T23:16:01.030\",\"lastModified\":\"2026-02-03T16:44:03.343\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user\u0027s Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims\u0027 Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim\u0027s Khoj search index. This attack requires knowing the user\u0027s UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"references\":[{\"url\":\"https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-69207\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-03T15:44:16.914965Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-03T15:45:34.044Z\"}}], \"cna\": {\"title\": \"Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning\", \"source\": {\"advisory\": \"GHSA-6whj-7qmg-86qj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"khoj-ai\", \"product\": \"khoj\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.0.0-beta.23\"}]}], \"references\": [{\"url\": \"https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj\", \"name\": \"https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b\", \"name\": \"https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23\", \"name\": \"https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user\u0027s Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims\u0027 Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim\u0027s Khoj search index. This attack requires knowing the user\u0027s UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-02T21:16:49.041Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-69207\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-03T15:45:38.393Z\", \"dateReserved\": \"2025-12-29T14:54:59.520Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-02T21:16:49.041Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-69207

Vulnerability from fkie_nvd - Published: 2026-02-02 23:16 - Updated: 2026-02-03 16:44

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b
	security-advisories@github.com	https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23
	security-advisories@github.com	https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user\u0027s Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims\u0027 Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim\u0027s Khoj search index. This attack requires knowing the user\u0027s UUID which can be leaked through shared conversations where an AI generated image is present. This vulnerability is fixed in 2.0.0-beta.23."
    }
  ],
  "id": "CVE-2025-69207",
  "lastModified": "2026-02-03T16:44:03.343",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-02T23:16:01.030",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-6WHJ-7QMG-86QJ

Vulnerability from github – Published: 2026-02-02 17:31 – Updated: 2026-02-03 16:09

Summary

Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning

Details

Summary

An IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims' Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim's Khoj search index.

This attack requires knowing the user's UUID which can be leaked through shared conversations where an AI generated image is present.

Details

When users share conversations which contain AI generated images, the file path for the image is constructed using the user's UUID. Knowing this UUID, an attacker is able to intercept the OAuth callback for Notion and replace the state parameter with the other user's UUID and sync notion onto their account.

PoC

The vulnerable line of code exists in src/khoj/routers/notion.py on the callback endpoint.

@notion_router.get("/auth/callback")
async def notion_auth_callback(request: Request, background_tasks: BackgroundTasks):
    code = request.query_params.get("code")
    state = request.query_params.get("state")  # <-- Attacker controlled
    if not code or not state:
        return Response("Missing code or state", status_code=400)

    user: KhojUser = await aget_user_by_uuid(state)  # <-- No verification!

    await NotionConfig.objects.filter(user=user).adelete()  # <-- Deletes victim's config

    # ... OAuth token exchange ...

    access_token = final_response.get("access_token")
    await NotionConfig.objects.acreate(token=access_token, user=user)  # <-- Stores attacker's token

To exploit is relatively easy. Once we know the victim's UUID, we simply initiate the Notion sync process on our own account and intercept the callback, replacing the state parameter with the victim's UUID.

Impact

Deletes user's existing Notion sync and replaces it with attacker-controlled Notion. Could allow for index poisoning. I'm not entirely sure what Khoj does with synced files but if it's being passed as context to an LLM then I can imagine there's potential here.

Severity ?

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "khoj"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.0b25.dev3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-69207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T17:31:33Z",
    "nvd_published_at": "2026-02-02T23:16:01Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn IDOR in the Notion OAuth callback allows an attacker to hijack any user\u0027s Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims\u0027 Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim\u0027s Khoj search index.\n\nThis attack requires knowing the user\u0027s UUID which can be leaked through shared conversations where an AI generated image is present.\n\n### Details\nWhen users share conversations which contain AI generated images, the file path for the image is constructed using the user\u0027s UUID. Knowing this UUID, an attacker is able to intercept the OAuth callback for Notion and replace the `state` parameter with the other user\u0027s UUID and sync notion onto their account.\n\n### PoC\n\nThe vulnerable line of code exists in `src/khoj/routers/notion.py` on the callback endpoint.\n```python\n@notion_router.get(\"/auth/callback\")\nasync def notion_auth_callback(request: Request, background_tasks: BackgroundTasks):\n    code = request.query_params.get(\"code\")\n    state = request.query_params.get(\"state\")  # \u003c-- Attacker controlled\n    if not code or not state:\n        return Response(\"Missing code or state\", status_code=400)\n\n    user: KhojUser = await aget_user_by_uuid(state)  # \u003c-- No verification!\n\n    await NotionConfig.objects.filter(user=user).adelete()  # \u003c-- Deletes victim\u0027s config\n    \n    # ... OAuth token exchange ...\n    \n    access_token = final_response.get(\"access_token\")\n    await NotionConfig.objects.acreate(token=access_token, user=user)  # \u003c-- Stores attacker\u0027s token\n```\n\nTo exploit is relatively easy. Once we know the victim\u0027s UUID, we simply initiate the Notion sync process on our own account and intercept the callback, replacing the `state` parameter with the victim\u0027s UUID.\n\n### Impact\nDeletes user\u0027s existing Notion sync and replaces it with attacker-controlled Notion. Could allow for index poisoning. I\u0027m not entirely sure what Khoj does with synced files but if it\u0027s being passed as context to an LLM then I can imagine there\u0027s potential here.",
  "id": "GHSA-6whj-7qmg-86qj",
  "modified": "2026-02-03T16:09:54Z",
  "published": "2026-02-02T17:31:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69207"
    },
    {
      "type": "WEB",
      "url": "https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/khoj-ai/khoj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-69207 (GCVE-0-2025-69207)

FKIE_CVE-2025-69207

GHSA-6WHJ-7QMG-86QJ

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature